[1.6.x] Fixed is_safe_url() to handle leading whitespace.

This is a security fix. Disclosure following shortly.

1 files changed, 2 insertions, 1 deletions

diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py
index 83dcd7c66a..60457fd438 100644
--- a/tests/utils_tests/test_http.py
+++ b/tests/utils_tests/test_http.py
@@ -109,7 +109,8 @@ class TestUtilsHttp(unittest.TestCase):
                         'http:/\//example.com',
                         'http:\/example.com',
                         'http:/\example.com',
-                        'javascript:alert("XSS")'):
+                        'javascript:alert("XSS")',
+                        '\njavascript:alert(x)'):
             self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url)
         for good_url in ('/view/?param=http://example.com',
                      '/view/?param=https://example.com',