From: Ben Darnell Date: Tue, 9 Dec 2025 15:40:18 +0000 (-0500) Subject: demos: Fix open redirects X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=778509257e261969ed2f6ba8099f960fb425892d;p=thirdparty%2Ftornado.git demos: Fix open redirects Several demos had handlers that redirected to a "next" URL provided as a query parameter without validating it first. --- diff --git a/demos/blog/blog.py b/demos/blog/blog.py index e6e23f85b..cfa84f942 100755 --- a/demos/blog/blog.py +++ b/demos/blog/blog.py @@ -132,6 +132,14 @@ class BaseHandler(tornado.web.RequestHandler): async def any_author_exists(self): return bool(await self.query("SELECT * FROM authors LIMIT 1")) + def redirect_to_next(self): + next = self.get_argument("next", "/") + if next.startswith("//") or not next.startswith("/"): + # Absolute URLs are not allowed because this would be an open redirect + # vulnerability (https://cwe.mitre.org/data/definitions/601.html). + raise tornado.web.HTTPError(400) + self.redirect(next) + class HomeHandler(BaseHandler): async def get(self): @@ -243,7 +251,7 @@ class AuthCreateHandler(BaseHandler): tornado.escape.to_unicode(hashed_password), ) self.set_signed_cookie("blogdemo_user", str(author.id)) - self.redirect(self.get_argument("next", "/")) + self.redirect_to_next() class AuthLoginHandler(BaseHandler): @@ -270,7 +278,7 @@ class AuthLoginHandler(BaseHandler): ) if password_equal: self.set_signed_cookie("blogdemo_user", str(author.id)) - self.redirect(self.get_argument("next", "/")) + self.redirect_to_next() else: self.render("login.html", error="incorrect password") @@ -278,7 +286,7 @@ class AuthLoginHandler(BaseHandler): class AuthLogoutHandler(BaseHandler): def get(self): self.clear_cookie("blogdemo_user") - self.redirect(self.get_argument("next", "/")) + self.redirect_to_next() class EntryModule(tornado.web.UIModule): diff --git a/demos/blog/templates/base.html b/demos/blog/templates/base.html index e21f29a3d..0c94e527b 100644 --- a/demos/blog/templates/base.html +++ b/demos/blog/templates/base.html @@ -1,27 +1,31 @@ - - - {{ escape(handler.settings["blog_title"]) }} - - - {% block head %}{% end %} - - -
-