Samin061 opened a new pull request, #70215: URL: https://github.com/apache/airflow/pull/70215
`is_safe_url` in `airflow-core/src/airflow/api_fastapi/core_api/security.py` rejects a leading `//`, `/\`, `\/` and `\\`, but not a backslash that follows the scheme, so `https:\\evil.com` is parsed by urllib as a relative path, `urljoin` re-attaches the base netloc, and the netloc comparison passes. Browsers follow WHATWG, where `\` is `/` for special schemes, so the same string navigates to `https://evil.com` — `GET /auth/token/login?next=https:\\evil.com` returns it verbatim as the redirect location and `GET /auth/login?next=` forwards it to the auth manager login page, both without authentication. Normalising backslashes to forward slashes before the prefix check and the parse makes the helper agree with the parser that actually resolves the value; the second `unquote` goes away with it so the guard and the resolution look at the same string. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
