Opened 12 months ago

Last modified 9 months ago

#36000 closed Cleanup/optimization

Update default from http to https in urlize when protocol not provided — at Version 1

Reported by: Saravana Owned by:
Component: Template system Version: 5.1
Severity: Normal Keywords:
Cc: Saravana Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description (last modified by Sarah Boyce)

In django/utils/html.py, urlize there is:

url = smart_urlquote("http://%s" % html.unescape(middle))

When user input does not include a protocol it defaults to http (Insecure Protocol).

Example :
Considered a web app using urlize() for password reset email template

input = "Password reset link myapp.com/password/reset/{token}"

output:

"Password reset link <a href="http://myapp.com/password/reset/{token}"/>"

so when end user of myapp clicks it the url with token sent in http insecure protocol.
This behavior could potentially lead to man-in-the-middle attacks

Suggested Fix:
Default to HTTPS: If the URL doesn't specify a protocol, Django could default to ​https://

Change History (1)

comment:1 by Sarah Boyce, 12 months ago

Description: modified (diff)
Has patch: unset
Summary: Insecure URL Handling (HTTP Protocol Default) in urlize → Update default from http to https in urlize when protocol not provided
Triage Stage: Unreviewed → Accepted

Thank you!
Note that the security team discussed this and agreed this can be handled publicly. This is similar to #34380.

Note: See TracTickets for help on using tickets.
Back to Top