mirror of
https://github.com/zulip/zulip.git
synced 2025-11-07 07:23:22 +00:00
c726d2ec01
Providing a signed Camo URL for arbitrary URLs opened the server up to being an open redirector. Return 403 if the URL is not a user upload, and the backend image if it is. Since we do not have ImageAttachment rows for uploads at a time we wrote `/thumbnail?` URLs, return the full-size content.
21 lines
779 B
Python
21 lines
779 B
Python
from urllib.parse import urljoin
|
|
|
|
from django.http import HttpRequest, HttpResponse, HttpResponseForbidden
|
|
from django.shortcuts import redirect
|
|
from django.utils.http import url_has_allowed_host_and_scheme
|
|
|
|
from zerver.lib.camo import is_camo_url_valid
|
|
|
|
|
|
def handle_camo_url(
|
|
request: HttpRequest, digest: str, received_url: str
|
|
) -> HttpResponse: # nocoverage
|
|
original_url = bytes.fromhex(received_url).decode()
|
|
if is_camo_url_valid(digest, original_url):
|
|
original_url = urljoin("/", original_url)
|
|
if url_has_allowed_host_and_scheme(original_url, allowed_hosts=None):
|
|
return redirect(original_url)
|
|
return HttpResponseForbidden("<p>Not a valid URL.</p>")
|
|
else:
|
|
return HttpResponseForbidden("<p>Not a valid URL.</p>")
|