-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Closed
Labels
Description
The open redirect protection for this example is still vulnerable
codeql/python/ql/src/Security/CWE-601/examples/redirect_good2.py
Lines 8 to 12 in dea9229
target = request.args.get('target', '') | |
target = target.replace('\\', '') | |
if not urlparse(target).netloc: | |
# relative path, safe to redirect | |
return redirect(target, code=302) |
A target like https:/example.com
(notice the single /
) will be parsed as having no netloc, but browsers will redirect to https://example.com
(tested on Firefox and Chrome using Fedora).
from urllib.parse import urlparse
print(urlparse('https:/example.com'))
# ParseResult(scheme='https', netloc='', path='/example.com', params='', query='', fragment='')
See Django for example