Prevent XSS in ?back attr

socialsystem/core/views.py

@@ -1,3 +1,5 @@
+import urllib
+
 from django.views.generic import TemplateView, FormView, DetailView
 from django.urls import reverse
 
@@ -64,7 +66,11 @@ class BenefitDetailView(DetailView):
     def get_context_data(self, *args, **kwargs):
         data = super().get_context_data(*args, **kwargs)
 
-        if self.request.GET.get('back', None) is not None:
-            data['back_link'] = self.request.GET['back']
+        back = self.request.GET.get('back', None)
+        parsed_back_url = urllib.parse.urlparse(back)
+
+        # We only allow blank scheme, e.g. relative urls to avoid reflected XSS
+        if back is not None and parsed_back_url.scheme == "":
+            data['back_link'] = back
 
         return data