#27912: Open redirect on non-HTTP protocols: is_safe_url not validating properly
-----------------------------------------+------------------------
Reporter: roks0n | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
For this to work, you have to first convert IPv4 (208.118.235.20) into a
decimal IP (3497454356).
**GIVEN** I am given a link, e.g.
https://example.com/admin/logout/?next=ftp:3497454356
**WHEN** I click on the link (in this case, if I'm logged in)
**THEN** I am redirected to ftp://208.118.235.20
Above also works for https://example.com/admin/login/?next=ftp:3497454356
{{{
In [1]: from django.utils.http import is_safe_url
In [2]: is_safe_url('http:999999999')
Out[2]: False
In [3]: is_safe_url('ftp:999999999')
Out[3]: True
In [4]: is_safe_url('ftp:999999999/test/')
Out[4]: False
In [5]: is_safe_url('ftp:9999999999', host='example.com')
Out[5]: True
In [6]: is_safe_url('http:9999999999', host='example.com')
Out[6]: False
In [7]: is_safe_url('https:9999999999', host='example.com')
Out[7]: True
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/27912>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.978a74356c3f80848fcd2c6fea305bae%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
