Discussion : Redirections ouvertes : valider la cible vers laquelle un paramètre next peut rediriger la personne utilisatrice

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Traduction indisponible ; l’original est affiché. Original

Two reference points for the validation code. Django ships `django.utils.http.url_has_allowed_host_and_scheme(url, allowed_hosts, require_https)` (named `is_safe_url` before 3.0), which is what its login view uses for the `next` parameter and which handles the `//host`, backslash and scheme-less shapes on the article's test list; reading its source is a short way to see the checks in one place. On the parser caveat: CVE-2023-24329 was exactly the class of bug the article warns about, where `urllib.parse` did not strip leading blank characters, so a scheme check could be bypassed with a leading space; it was fixed in Python 3.11.4 and 3.12. In JavaScript, `new URL(candidate, base).origin` compared against an allowlist uses the same WHATWG parser as the browser, which removes the parser-disagreement problem for that side of the check.