From d22b90b4eabc1fe9b7b35aada441e0edf5ebd6d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20Suliga?= Date: Fri, 22 Jun 2018 11:21:52 +0200 Subject: [PATCH] Fixed #29525 -- Allowed is_safe_url()'s allowed_hosts arg to be a string. --- AUTHORS | 1 + django/utils/http.py | 2 ++ tests/utils_tests/test_http.py | 4 ++++ 3 files changed, 7 insertions(+) diff --git a/AUTHORS b/AUTHORS index f95e3ea15d..c2fad3204b 100644 --- a/AUTHORS +++ b/AUTHORS @@ -678,6 +678,7 @@ answer newbie questions, and generally made Django that much better: Preston Holmes Preston Timmons Priyansh Saxena + Przemysław Suliga Rachel Tobin Rachel Willmer Radek Švarz diff --git a/django/utils/http.py b/django/utils/http.py index 4558c6874a..caaab4f9e5 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -298,6 +298,8 @@ def is_safe_url(url, allowed_hosts, require_https=False): return False if allowed_hosts is None: allowed_hosts = set() + elif isinstance(allowed_hosts, str): + allowed_hosts = {allowed_hosts} # Chrome treats \ completely as / in paths but it could be part of some # basic auth credentials so we need to check both URLs. return (_is_safe_url(url, allowed_hosts, require_https=require_https) and diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py index 86fcff9d8e..05b43c814f 100644 --- a/tests/utils_tests/test_http.py +++ b/tests/utils_tests/test_http.py @@ -165,6 +165,10 @@ class IsSafeURLTests(unittest.TestCase): # Basic auth without host is not allowed. self.assertIs(is_safe_url(r'http://testserver\@example.com', allowed_hosts=None), False) + def test_allowed_hosts_str(self): + self.assertIs(is_safe_url('http://good.com/good', allowed_hosts='good.com'), True) + self.assertIs(is_safe_url('http://good.co/evil', allowed_hosts='good.com'), False) + def test_secure_param_https_urls(self): secure_urls = ( 'https://example.com/p',