Flask-Middleware / flask-security

Quick and simple security for Flask applications
MIT License
624 stars 155 forks source link

Fix (again) possible open redirect vulnerability. #896

Closed jwag956 closed 6 months ago

jwag956 commented 6 months ago

Improve the regex (thanks Brandon Elliot) to catch more crafted relative paths that browsers convert to absolute.

Add the "absolute" option to SECURITY_REDIRECT_VALIDATE_MODE which restores Werkzeug prior behavior of converting all Location header values into absolute paths rather than relative (autocorrect_location_header=True).

closes #893

codecov[bot] commented 6 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (92e3fb6) 98.29% compared to head (4debe75) 98.34%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #896 +/- ## ========================================== + Coverage 98.29% 98.34% +0.04% ========================================== Files 34 34 Lines 4465 4474 +9 ========================================== + Hits 4389 4400 +11 + Misses 76 74 -2 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.