From 1af2052513cb6161c777936ccf6d2b37691bd15b Mon Sep 17 00:00:00 2001
From: Mark <mark@openappstack.net>
Date: Fri, 25 Oct 2019 15:08:13 +0200
Subject: [PATCH] Add docstring fir helper function
---
login_provider/helper.py | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/login_provider/helper.py b/login_provider/helper.py
index 491bc56..d4efb1d 100644
--- a/login_provider/helper.py
+++ b/login_provider/helper.py
@@ -1,6 +1,23 @@
import re
+
def is_safe_url(url):
+ """Checks if a url is safe
+
+ Check if a url is safe to be used in redirects. This function is used whenever the user
+ passes a redirect url to the application. In case of the login process the user passes
+ a url to the application via a HTTP-GET variable, namely `next`. Once the user successfully
+ authenticated, the url is used by the server to redirect to the page the user initially
+ requested. The url validation prevents attacks where an attacker creates links that
+ redirect users to malicious urls once they are loged in.
+ example: http://login-provider/login?next=malicious\.org/
+
+ Args:
+ url: Url that needs to be validated
+
+ Returns:
+ True if the url is trusted. False if not.
+ """
safe_urls = [
"^[/]*$", # Home page
"^/\?login_challenge=[a-z|A-Z|0-9]+$" # Login challenge with alphanumeric code
--
GitLab