Anders Kaseorg 319e2231b8 thumbnail: Tighten fix for CVE-2019-19775 open redirect. ...

Due to a known but unfixed bug in the Python standard library’s
urllib.parse module (CVE-2015-2104), a crafted URL could bypass the
validation in the previous patch and still achieve an open redirect.

https://bugs.python.org/issue23505

Switch to using django.utils.http.is_safe_url, which already contains
a workaround for this bug.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>

2020-01-16 12:36:24 -08:00

2.6 KiB

Raw Blame History

View Raw