Fix open redirect in account views and URL shortener

logoutView, loginView, and updateProfile accepted arbitrary URLs in the
nextPage parameter and passed them directly to HttpResponseRedirect.
Validate nextPage against the current host using Django's
url_has_allowed_host_and_scheme so external redirects are rejected.

The URL shortener's shorten view stored paths with leading slashes intact.
When follow() concatenated reverse('browser') with a path like //evil.com,
some browsers normalize the result to a protocol-relative URL pointing
externally. Strip leading slashes from the stored path at write time to
prevent this.

Tests added for both cases. Fixes #2871 and #2872.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Vishnu Kosuri

webapp/graphite/account/views.py

@@ -19,16 +19,26 @@
     from django.urls import reverse
 from django.http import HttpResponseRedirect
 from django.shortcuts import render
+from django.utils.http import url_has_allowed_host_and_scheme
 from graphite.user_util import getProfile, isAuthenticated
 
 
+def _safe_next_page(request, raw):
+    url_is_safe = url_has_allowed_host_and_scheme(
+        url=raw,
+        allowed_hosts={request.get_host()},
+        require_https=request.is_secure(),
+    )
+    return raw if url_is_safe else reverse('browser')
+
+
 def loginView(request):
     username = request.POST.get('username')
     password = request.POST.get('password')
     if request.method == 'GET':
-        nextPage = request.GET.get('nextPage', reverse('browser'))
+        nextPage = _safe_next_page(request, request.GET.get('nextPage', reverse('browser')))
     else:
-        nextPage = request.POST.get('nextPage', reverse('browser'))
+        nextPage = _safe_next_page(request, request.POST.get('nextPage', reverse('browser')))
     if username and password:
         user = authenticate(username=username,password=password)
         if user is None:
@@ -43,7 +53,7 @@ def loginView(request):
 
 
 def logoutView(request):
-    nextPage = request.GET.get('nextPage', reverse('browser'))
+    nextPage = _safe_next_page(request, request.GET.get('nextPage', reverse('browser')))
     logout(request)
     return HttpResponseRedirect(nextPage)
 
@@ -60,5 +70,5 @@ def updateProfile(request):
     if profile:
         profile.advancedUI = request.POST.get('advancedUI','off') == 'on'
         profile.save()
-    nextPage = request.POST.get('nextPage', reverse('browser'))
+    nextPage = _safe_next_page(request, request.POST.get('nextPage', reverse('browser')))
     return HttpResponseRedirect(nextPage)

webapp/graphite/url_shortener/views.py

@@ -22,6 +22,9 @@ def shorten(request, path):
         path += '?' + request.META['QUERY_STRING']
     # Remove _salt, _dc and _uniq to avoid creating many copies of the same URL
     path = re.sub('&_(uniq|salt|dc)=[0-9.]+', "", path)
+    # Strip leading slashes so the stored path, when concatenated with
+    # reverse('browser'), cannot produce a protocol-relative URL like //host.
+    path = path.lstrip('/')
 
     link, created = Link.objects.get_or_create(url=path)
     link_id = base62.from_decimal(link.id)

webapp/tests/test_xss.py

@@ -40,3 +40,32 @@ def test_render_xss(self):
 
         response = self.client.get(url, {'query': 'test', 'local': xssStr, 'from': xssStr, 'tz': xssStr})
         self.assertXSS(response, status_code=400, msg_prefix='XSS detected: ')
+
+
+class LogoutOpenRedirectTest(TestCase):
+    def test_logout_external_redirect_blocked(self):
+        url = reverse('account_logout')
+        response = self.client.get(url, {'nextPage': 'http://evil.example.com'})
+        location = response.get('Location', '')
+        self.assertNotIn('evil.example.com', location)
+
+    def test_logout_local_redirect_allowed(self):
+        url = reverse('account_logout')
+        response = self.client.get(url, {'nextPage': '/browser/'})
+        location = response.get('Location', '')
+        self.assertEqual(location, '/browser/')
+
+
+class URLShortenerOpenRedirectTest(TestCase):
+    def test_shorten_strips_leading_slashes(self):
+        shorten_url = reverse('shorten', kwargs={'path': '//evil.example.com'})
+        shorten_response = self.client.get(shorten_url)
+        self.assertEqual(shorten_response.status_code, 200)
+        link_id = shorten_response.content.decode('utf-8').rsplit('/', 1)[-1]
+        follow_url = reverse('follow', kwargs={'link_id': link_id})
+        follow_response = self.client.get(follow_url)
+        location = follow_response.get('Location', '')
+        self.assertFalse(
+            location.startswith('//') or location.startswith('http://evil') or location.startswith('https://evil'),
+            msg='Open redirect detected: %s' % location,
+        )