diff --git a/login_provider/helper.py b/login_provider/helper.py index 491bc564a81312605fccb9891d984093d3d4c543..d4efb1da4f8d0b8b361936abbda918c21c49aa87 100644 --- a/login_provider/helper.py +++ b/login_provider/helper.py @@ -1,6 +1,23 @@ import re + def is_safe_url(url): + """Checks if a url is safe + + Check if a url is safe to be used in redirects. This function is used whenever the user + passes a redirect url to the application. In case of the login process the user passes + a url to the application via a HTTP-GET variable, namely `next`. Once the user successfully + authenticated, the url is used by the server to redirect to the page the user initially + requested. The url validation prevents attacks where an attacker creates links that + redirect users to malicious urls once they are loged in. + example: http://login-provider/login?next=malicious\.org/ + + Args: + url: Url that needs to be validated + + Returns: + True if the url is trusted. False if not. + """ safe_urls = [ "^[/]*$", # Home page "^/\?login_challenge=[a-z|A-Z|0-9]+$" # Login challenge with alphanumeric code