Changes between Initial Version and Version 1 of Ticket #36000


Ignore:
Timestamp:
Dec 11, 2024, 10:54:03 AM (7 days ago)
Author:
Sarah Boyce
Comment:

Thank you! Note that the security team discussed this and agreed this can be handled publicly. This is similar to #34380.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #36000

    • Property Has patch unset
    • Property Triage Stage Unreviewed → Accepted
    • Property Summary Insecure URL Handling (HTTP Protocol Default) in urlize → Update default from http to https in urlize when protocol not provided

  • Ticket #36000 – Description

    initial v1  
    1 Hi Team,
    2 In django/utils/html.py  ,Line no 347 ,Due to following code,
     1In `django/utils/html.py`, `urlize` there is:
     2{{{
    33url = smart_urlquote("http://%s" % html.unescape(middle))
     4}}}
    45
    5 When user input does not include protocol it defaultly prefers http (Insecure Protocol).
     6When user input does not include a protocol it defaults to http (Insecure Protocol).
     7
    68Example :
    7 Considered a web app using urlize() for password reset email template
    8 input = Password reset link myapp.com/password/reset/{token}
    9 output,
    10 Password reset link <a href="http://myapp.com/password/reset/{token}"/>
     9Considered a web app using `urlize()` for password reset email template
     10{{{
     11input = "Password reset link myapp.com/password/reset/{token}"
     12}}}
     13output:
     14{{{
     15"Password reset link <a href="http://myapp.com/password/reset/{token}"/>"
     16}}}
     17
    1118so when end user of myapp clicks it the url with token sent in http insecure protocol.
    12 
    1319This behavior could potentially lead to man-in-the-middle attacks
    1420
Back to Top