Opened 53 minutes ago

Closed 50 minutes ago

#36760 closed Bug (duplicate)

DisallowedRedirect triggering exceptions for simple bad bot traffic

Reported by: minusf Owned by:
Component: Core (URLs) Version: 5.2
Severity: Normal Keywords:
Cc: Triage Stage: Unreviewed
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

The latest changes to DisallowedRedirect (CVE-2025-64458) are triggering thousands and thousands of exception emails and spam the logs when simple bad bot traffic is sending requests without a trailing slash and longer than django.utils.http.MAX_URL_LENGTH.

Tangentionally the docstring for DisallowedRedirect is now out of date/incorrect:

class DisallowedRedirect(SuspiciousOperation):
    """Redirect to scheme not in allowed list"""

I feel like this is a bit overreacting and perhaps could be toned down somehow?

Change History (2)

comment:1 by minusf, 51 minutes ago

ah sorry, duplicate of #36743

comment:2 by minusf, 50 minutes ago

Resolution: → duplicate
Status: new → closed
Note: See TracTickets for help on using tickets.
Back to Top