[change] Honor notification data["url"] for the web target link

openwisp_notifications/api/serializers.py

@@ -1,4 +1,5 @@
 import logging
+from urllib.parse import urlparse
 
 from django.db import models
 from rest_framework import serializers
@@ -47,6 +48,20 @@ def get_field_names(self, declared_fields, info):
         model_fields = super().get_field_names(declared_fields, info)
         return model_fields + self.Meta.extra_fields
 
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        url = (instance.data or {}).get("url")
+        if url and self._is_safe_target_url(url):
+            data["target_url"] = url
+        return data
+
+    @staticmethod
+    def _is_safe_target_url(url):
+        """Allows only relative paths or http(s) URLs as the redirect target."""
+        if url.startswith("//"):
+            return False
+        return urlparse(url).scheme in ("", "http", "https")
+
     @property
     def data(self):
         try:

openwisp_notifications/tests/test_notifications.py

@@ -25,6 +25,7 @@
 
 from openwisp_notifications import settings as app_settings
 from openwisp_notifications import tasks, utils
+from openwisp_notifications.api.serializers import NotificationSerializer
 from openwisp_notifications.exceptions import NotificationRenderException
 from openwisp_notifications.handlers import (
     notify_handler,
@@ -771,6 +772,42 @@ def test_notification_type_related_object_url(self):
                 notification.target_url, "https://target.example.com/index#heading"
             )
 
+    def test_target_url_data_override(self):
+        target = self._create_user(username="target", email="target@example.com")
+        self.notification_options.update({"target": target})
+        with self.subTest("data url is used as the notification link"):
+            self._create_notification()
+            n = Notification.objects.first()
+            self.assertEqual(
+                NotificationSerializer(n).data["target_url"],
+                "https://localhost:8000/admin",
+            )
+            self.assertIn(str(target.pk), n.target_url)
+        with self.subTest("a relative data url is honored"):
+            Notification.objects.all().delete()
+            self.notification_options.update({"url": "/admin/?status=pending"})
+            self._create_notification()
+            n = Notification.objects.first()
+            self.assertEqual(
+                NotificationSerializer(n).data["target_url"], "/admin/?status=pending"
+            )
+        with self.subTest("an unsafe scheme falls back to the target object URL"):
+            for unsafe in ("javascript:alert(1)", "//evil.example.com"):
+                Notification.objects.all().delete()
+                self.notification_options.update({"url": unsafe})
+                self._create_notification()
+                n = Notification.objects.first()
+                self.assertEqual(
+                    NotificationSerializer(n).data["target_url"], n.target_url
+                )
+        with self.subTest("falls back to the target object URL without a data url"):
+            Notification.objects.all().delete()
+            self.notification_options.pop("url")
+            self._create_notification()
+            n = Notification.objects.first()
+            self.assertEqual(NotificationSerializer(n).data["target_url"], n.target_url)
+            self.assertIn(str(target.pk), n.target_url)
+
     @capture_any_output()
     @mock_notification_types
     @patch("openwisp_notifications.tasks.delete_notification.delay")