id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
13751	Avoid open redirect issue with whitelist	anonymous		"An [http://www.owasp.org/index.php/Open_redirect open redirect] is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.

For example, the login page could be rewrite with a suspicious `next` parameter

http://your_domain_name/login/next=http://www.google.com

and the user will be redirect to the target URL after login, you could check the following document for more detail and suggestion.

http://www.google.com/support/webmasters/bin/answer.py?answer=171297

Even it is not a security issue from Django itself, we still need to provide security mechanism to avoid it, such as whitelist, secure hash etc

{{{
#!/usr/bin/env python
import re
import logging

from urlparse import urlparse

import django.http 
from django.conf import settings

class HttpResponseSafeRedirect(django.http.HttpResponse):
    status_code = 302
    
    def __init__(self, redirect_to, whitelist=[], fallback_to=None):
        django.http.HttpResponse.__init__(self)
        
        self['Location'] = redirect_to
    
        if urlparse(self['Location']).scheme:
            matched = False
            
            for pattern in whitelist:
                if hasattr(pattern, 'match'):
                    matched = pattern.match(self['Location'])
                    break
                else:
                    matched = self['Location'].startswith(pattern)
                    break
            
            if not matched:
                logging.warn(""found open redirect attack to %s"", self['Location'])
                
                self['Location'] = fallback_to or settings.LOGIN_REDIRECT_URL

django.http.HttpResponseRedirect = HttpResponseSafeRedirect
}}}"	New feature	closed	HTTP handling	dev	Normal	wontfix	open redirect, security	d1b djfische@…	Accepted	1	0	0	0	0	0