[1.7.x] Added additional checks in is_safe_url to account for flexible parsing.

This is a security fix. Disclosure following shortly.

1 files changed, 12 insertions, 0 deletions

diff --git a/django/utils/http.py b/django/utils/http.py
index e3365776f3..28245d23f4 100644
--- a/django/utils/http.py
+++ b/django/utils/http.py
@@ -272,6 +272,18 @@ def is_safe_url(url, host=None):
     """
     if not url:
         return False
+    # Chrome treats \ completely as /
+    url = url.replace('\\', '/')
+    # Chrome considers any URL with more than two slashes to be absolute, but
+    # urlaprse is not so flexible. Treat any url with three slashes as unsafe.
+    if url.startswith('///'):
+        return False
     url_info = urlparse(url)
+    # Forbid URLs like http:///example.com - with a scheme, but without a hostname.
+    # In that URL, example.com is not the hostname but, a path component. However,
+    # Chrome will still consider example.com to be the hostname, so we must not
+    # allow this syntax.
+    if not url_info.netloc and url_info.scheme:
+        return False
     return ((not url_info.netloc or url_info.netloc == host) and
             (not url_info.scheme or url_info.scheme in ['http', 'https']))