mistercrunch commented on code in PR #31692:
URL: https://github.com/apache/superset/pull/31692#discussion_r2019614994
##########
superset/utils/urls.py:
##########
@@ -62,3 +62,20 @@ def is_secure_url(url: str) -> bool:
"""
parsed_url = urlparse(url)
return parsed_url.scheme == "https"
+
+
+def is_safe_redirect_url(source_url: str, target_url: str) -> bool:
Review Comment:
sorry for the multi-phase review, but GPT recommends further checking here,
and since this is security for XSS I'm thinking let's do it...
```
def is_safe_redirect_url(source_url: str, target_url: str) -> bool:
if not target_url:
return False
joined = urljoin(source_url, target_url) # resolves relative URLs
parsed_source = urlparse(source_url)
parsed_target = urlparse(joined)
return (
parsed_source.scheme == parsed_target.scheme and
parsed_source.hostname == parsed_target.hostname
)
```
GPT says: This handles edge cases like user-supplied target_url values
starting with // (which browsers interpret as external redirects) or other
relative path tricks. Using urljoin() ensures we're validating the fully
resolved URL against the expected scheme and host. Safer for open internet
exposure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
