fix(security): [HIGH] resolve open redirect bypass in get_safe_redirect_url#86
fix(security): [HIGH] resolve open redirect bypass in get_safe_redirect_url#86Tugamer89 wants to merge 1 commit into
Conversation
Prevent Open Redirects using malformed URLs (e.g. `http:evil.com` or `http:///evil.com`) where urlparse returns a valid scheme but an empty netloc. These were previously bypassing the `parsed.netloc != request_host` check because `parsed.netloc` was empty. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
1 participant
Severity: HIGH
Vulnerability: Open Redirect bypass in
get_safe_redirect_urldue to improper validation of malformed URLs.Impact: An attacker could craft a malformed URL (e.g.
http:evil.comorhttp:///evil.com) which would be parsed with an emptynetlocby Python'surllib.parse.urlparse. Because thenetlocwas empty, it bypassed the host-matching check, and the browser would auto-correct the malformed URL and redirect the user to the malicious site. This could be used for phishing attacks or stealing sensitive tokens.Fix: Added an explicit check (
if parsed.scheme and not parsed.netloc) to immediately return the root path if a URL has a scheme but no network location.Verification: Verified with a script testing various malformed variations, ensuring they are properly rejected while valid relative and matching absolute URLs still pass.
PR created automatically by Jules for task 15640077484547076906 started by @Tugamer89