Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open redirect to another domain after login with next query #9950

Closed
pellepelle3 opened this issue Aug 8, 2022 · 0 comments
Closed

Open redirect to another domain after login with next query #9950

pellepelle3 opened this issue Aug 8, 2022 · 0 comments
Assignees
Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application

Comments

@pellepelle3
Copy link

NetBox version

v3.2.7

Python version

3.9

Steps to Reproduce

On login the query string next can redirect to another domain with //www.google.com
/login/?next={path}
/login/?next=/home
/login/?next=//www.google.com

Expected Behavior

Only redirect to a Path of the current domain.
/login/?next=/home (success)
/login/?next=//www.google.com (should fail and redirect to home)

Observed Behavior

/login/?next=/home (success)
/login/?next=//www.google.com (success)

@pellepelle3 pellepelle3 added the type: bug A confirmed report of unexpected behavior in the application label Aug 8, 2022
@pellepelle3 pellepelle3 changed the title This Open redirect to another domain after login with next query Aug 8, 2022
@jeremystretch jeremystretch added the status: accepted This issue has been accepted for implementation label Aug 8, 2022
@jeremystretch jeremystretch self-assigned this Aug 8, 2022
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 7, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
status: accepted This issue has been accepted for implementation type: bug A confirmed report of unexpected behavior in the application
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants