[1.4.x] Made is_safe_url() reject URLs that start with control characters.

This is a security fix; disclosure to follow shortly.

1 files changed, 3 insertions, 1 deletions

diff --git a/tests/regressiontests/utils/http.py b/tests/regressiontests/utils/http.py
index 3ec237ae64..8245a7e54e 100644
--- a/tests/regressiontests/utils/http.py
+++ b/tests/regressiontests/utils/http.py
@@ -98,7 +98,9 @@ class TestUtilsHttp(unittest.TestCase):
                         'http:\/example.com',
                         'http:/\example.com',
                         'javascript:alert("XSS")'
-                        '\njavascript:alert(x)'):
+                        '\njavascript:alert(x)',
+                        '\x08//example.com',
+                        '\n'):
             self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url)
         for good_url in ('/view/?param=http://example.com',
                      '/view/?param=https://example.com',