#27912: Open redirect on non-HTTP protocols: is_safe_url not validating properly
-----------------------------------------+------------------------
Reporter: roks0n | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
For this to work, you have to first convert IPv4 (208.118.235.20) into a
decimal IP (3497454356).
**GIVEN** I am given a link, e.g.
https://example.com/admin/logout/?next=ftp:3497454356
**WHEN** I click on the link (in this case, if I'm logged in)
**THEN** I am redirected to ftp://208.118.235.20
Above also works for https://example.com/admin/login/?next=ftp:3497454356
{{{
In [1]: from django.utils.http import is_safe_url
In [2]: is_safe_url('http:999999999')
Out[2]: False
In [3]: is_safe_url('ftp:999999999')
Out[3]: True
In [4]: is_safe_url('ftp:999999999/test/')
Out[4]: False
In [5]: is_safe_url('ftp:9999999999', host='example.com')
Out[5]: True
In [6]: is_safe_url('http:9999999999', host='example.com')
Out[6]: False
In [7]: is_safe_url('https:9999999999', host='example.com')
Out[7]: True
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/27912>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.978a74356c3f80848fcd2c6fea305bae%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
