Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.

This is a security fix; disclosure to follow shortly.
  • Loading branch information...
commit 79594b40c087c19fecc72af042c835b11a519b78 1 parent 4f470f5
Jacob Kaplan-Moss authored
8  django/contrib/auth/tests/test_views.py
@@ -447,7 +447,8 @@ def test_security_check(self, password='password'):
447 447
         for bad_url in ('http://example.com',
448 448
                         'https://example.com',
449 449
                         'ftp://exampel.com',
450  
-                        '//example.com'):
  450
+                        '//example.com',
  451
+                        'javascript:alert("XSS")'):
451 452
 
452 453
             nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
453 454
                 'url': login_url,
@@ -468,6 +469,7 @@ def test_security_check(self, password='password'):
468 469
                          '/view?param=ftp://exampel.com',
469 470
                          'view/?param=//example.com',
470 471
                          'https:///',
  472
+                         'HTTPS:///',
471 473
                          '//testserver/',
472 474
                          '/url%20with%20spaces/'):  # see ticket #12534
473 475
             safe_url = '%(url)s?%(next)s=%(good_url)s' % {
@@ -662,7 +664,8 @@ def test_security_check(self, password='password'):
662 664
         for bad_url in ('http://example.com',
663 665
                         'https://example.com',
664 666
                         'ftp://exampel.com',
665  
-                        '//example.com'):
  667
+                        '//example.com',
  668
+                        'javascript:alert("XSS")'):
666 669
             nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
667 670
                 'url': logout_url,
668 671
                 'next': REDIRECT_FIELD_NAME,
@@ -681,6 +684,7 @@ def test_security_check(self, password='password'):
681 684
                          '/view?param=ftp://exampel.com',
682 685
                          'view/?param=//example.com',
683 686
                          'https:///',
  687
+                         'HTTPS:///',
684 688
                          '//testserver/',
685 689
                          '/url%20with%20spaces/'):  # see ticket #12534
686 690
             safe_url = '%(url)s?%(next)s=%(good_url)s' % {
7  django/utils/http.py
@@ -253,11 +253,12 @@ def same_origin(url1, url2):
253 253
 def is_safe_url(url, host=None):
254 254
     """
255 255
     Return ``True`` if the url is a safe redirection (i.e. it doesn't point to
256  
-    a different host).
  256
+    a different host and uses a safe scheme).
257 257
 
258 258
     Always returns ``False`` on an empty url.
259 259
     """
260 260
     if not url:
261 261
         return False
262  
-    netloc = urllib_parse.urlparse(url)[1]
263  
-    return not netloc or netloc == host
  262
+    url_info = urllib_parse.urlparse(url)
  263
+    return (not url_info.netloc or url_info.netloc == host) and \
  264
+        (not url_info.scheme or url_info.scheme in ['http', 'https'])

0 notes on commit 79594b4

Please sign in to comment.
Something went wrong with that request. Please try again.