Version 1.9.0 Release

[BlueSquare23]

No description provided.

In general, to fix untrusted URL redirection, do not redirect directly to user-supplied values (including headers like Referer). Instead, either (1) redirect to a known safe internal route, optionally preserving needed state via query parameters or server-side session, or (2) validate the user-provided URL against a strict policy (for example, allow only relative paths or a whitelist of hosts/paths).

For this specific function, the least intrusive fix while preserving existing behavior is to treat the “go back” redirect as an internal navigation: we should only redirect if the referrer points back to this same application and not to an arbitrary external site. A simple, robust approach in Flask is:

• Parse request.referrer with urllib.parse.urlparse.
• If it is empty or parsing shows a different hostname than the current request’s host, do not redirect there.
• Instead, fall back to a safe internal route (e.g., url_for("main.jobs")), which keeps the user on our site.
• This does not change core functionality for normal, honest traffic (where referrer is our own page) but blocks malicious external redirects.

We only need to modify the two places where request.referrer is used: line 96 and line 130 in app/blueprints/main/jobs.py. We'll add an import of urlparse from urllib.parse and replace those redirect(request.referrer) calls with a helper that validates the referrer. Since we must keep changes within the shown snippet, we can implement a small helper function directly in this file (above jobs()) that checks whether the referrer URL is same-origin (matches request.host) and only then redirects; otherwise it redirects to url_for("main.jobs").

In general, to fix untrusted URL redirection you must not redirect directly to user-controlled values. Instead, either (1) redirect only to fixed, server-controlled routes, or (2) validate any dynamic redirect target against a strict allowlist or ensure it is a safe relative URL (no scheme/host, no backslashes that might be interpreted as slashes).

In this function, the problematic line is:

130:         return redirect(request.referrer)

The simplest fix that does not change core functionality much is to fall back to a safe internal page (for example, the jobs page for that server, or the jobs index) when the referrer is unsafe or absent, and only use request.referrer when it is clearly an internal, relative URL. Since we must not rely on project-specific helpers outside the shown snippet, we can implement a small local validation using urllib.parse.urlparse from the standard library. That lets us distinguish relative paths (safe) from absolute URLs to external hosts (unsafe).

Concretely:

• Add an import for urlparse at the top: from urllib.parse import urlparse.
• Replace return redirect(request.referrer) with logic such as:
  • Get referrer = request.referrer or "".
  • Normalize backslashes out of the referrer string.
  • Parse it; if both netloc and scheme are empty (meaning it’s a relative URL/path), we treat it as safe and redirect to it.
  • Otherwise, ignore it and redirect to a safe default internal route, e.g. url_for("main.jobs", server_id=form.server_id.data) or just url_for("main.jobs").

Using url_for("main.jobs", server_id=form.server_id.data) as the fallback keeps behavior close to the intended “go back to the jobs view for this server” even when the referrer is missing or malicious.

All changes are within app/blueprints/main/jobs.py:

• At the imports region (around lines 3–11), add the urllib.parse import.
• At the POST branch failure case (around lines 129–130), replace the direct redirect with the validated-URL logic and fallback redirect.

---