diff --git a/src/twisted/web/_template_util.py b/src/twisted/web/_template_util.py index f4c4aba3540..501941ad121 100644 --- a/src/twisted/web/_template_util.py +++ b/src/twisted/web/_template_util.py @@ -92,7 +92,7 @@ def render_GET(self, request): """ % { - b"url": URL + b"url": escape(URL.decode("utf-8")).encode("utf-8") } return content diff --git a/src/twisted/web/newsfragments/12263.bugfix b/src/twisted/web/newsfragments/12263.bugfix new file mode 100644 index 00000000000..b3982ca0fb5 --- /dev/null +++ b/src/twisted/web/newsfragments/12263.bugfix @@ -0,0 +1 @@ +twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2). The issue is being tracked with CVE-2024-41810. \ No newline at end of file diff --git a/src/twisted/web/newsfragments/9839.bugfix b/src/twisted/web/newsfragments/9839.bugfix new file mode 100644 index 00000000000..1e2e7f72986 --- /dev/null +++ b/src/twisted/web/newsfragments/9839.bugfix @@ -0,0 +1 @@ +twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). diff --git a/src/twisted/web/test/test_util.py b/src/twisted/web/test/test_util.py index 1e763009ca9..9847dcbb8b5 100644 --- a/src/twisted/web/test/test_util.py +++ b/src/twisted/web/test/test_util.py @@ -5,7 +5,6 @@ Tests for L{twisted.web.util}. """ - import gc from twisted.internet import defer @@ -64,6 +63,44 @@ def test_redirectToUnicodeURL(self): targetURL = "http://target.example.com/4321" self.assertRaises(TypeError, redirectTo, targetURL, request) + def test_legitimateRedirect(self): + """ + Legitimate URLs are fully interpolated in the `redirectTo` response body without transformation + """ + request = DummyRequest([b""]) + html = redirectTo(b"https://twisted.org/", request) + expected = b""" + + + + + + click here + + +""" + self.assertEqual(html, expected) + + def test_maliciousRedirect(self): + """ + Malicious URLs are HTML-escaped before interpolating them in the `redirectTo` response body + """ + request = DummyRequest([b""]) + html = redirectTo( + b'https://twisted.org/">', request + ) + expected = b""" + + + + + + click here + + +""" + self.assertEqual(html, expected) + class ParentRedirectTests(SynchronousTestCase): """