[1.8.x] Made is_safe_url() reject URLs that start with control characters.

This is a security fix; disclosure to follow shortly.

1 files changed, 3 insertions, 1 deletions

diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py
index 7e48fe70a7..74c6905294 100644
--- a/tests/utils_tests/test_http.py
+++ b/tests/utils_tests/test_http.py
@@ -115,7 +115,9 @@ class TestUtilsHttp(unittest.TestCase):
                         'http:\/example.com',
                         'http:/\example.com',
                         'javascript:alert("XSS")',
-                        '\njavascript:alert(x)'):
+                        '\njavascript:alert(x)',
+                        '\x08//example.com',
+                        '\n'):
             self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url)
         for good_url in ('/view/?param=http://example.com',
                      '/view/?param=https://example.com',