diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/utils/http.py | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/django/utils/http.py b/django/utils/http.py index 70bcbd90ac..fb18f48f77 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -290,8 +290,12 @@ def is_safe_url(url, host=None): url = url.strip() if not url: return False - # Chrome treats \ completely as / - url = url.replace('\\', '/') + # Chrome treats \ completely as / in paths but it could be part of some + # basic auth credentials so we need to check both URLs. + return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host) + + +def _is_safe_url(url, host): # Chrome considers any URL with more than two slashes to be absolute, but # urlparse is not so flexible. Treat any url with three slashes as unsafe. if url.startswith('///'): |