Index: twisted-24.3.0/src/twisted/web/_template_util.py =================================================================== --- twisted-24.3.0.orig/src/twisted/web/_template_util.py +++ twisted-24.3.0/src/twisted/web/_template_util.py @@ -92,7 +92,7 @@ def redirectTo(URL: bytes, request: IReq """ % { - b"url": URL + b"url": escape(URL.decode("utf-8")).encode("utf-8") } return content Index: twisted-24.3.0/src/twisted/web/newsfragments/12263.bugfix =================================================================== --- /dev/null +++ twisted-24.3.0/src/twisted/web/newsfragments/12263.bugfix @@ -0,0 +1 @@ +twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2). The issue is being tracked with CVE-2024-41810. \ No newline at end of file Index: twisted-24.3.0/src/twisted/web/newsfragments/9839.bugfix =================================================================== --- /dev/null +++ twisted-24.3.0/src/twisted/web/newsfragments/9839.bugfix @@ -0,0 +1 @@ +twisted.web.util.redirectTo now HTML-escapes the provided URL in the fallback response body it returns (GHSA-cf56-g6w6-pqq2, CVE-2024-41810). Index: twisted-24.3.0/src/twisted/web/test/test_util.py =================================================================== --- twisted-24.3.0.orig/src/twisted/web/test/test_util.py +++ twisted-24.3.0/src/twisted/web/test/test_util.py @@ -5,7 +5,6 @@ Tests for L{twisted.web.util}. """ - import gc from twisted.internet import defer @@ -64,6 +63,44 @@ class RedirectToTests(TestCase): targetURL = "http://target.example.com/4321" self.assertRaises(TypeError, redirectTo, targetURL, request) + def test_legitimateRedirect(self): + """ + Legitimate URLs are fully interpolated in the `redirectTo` response body without transformation + """ + request = DummyRequest([b""]) + html = redirectTo(b"https://twisted.org/", request) + expected = b""" + + + + + + click here + + +""" + self.assertEqual(html, expected) + + def test_maliciousRedirect(self): + """ + Malicious URLs are HTML-escaped before interpolating them in the `redirectTo` response body + """ + request = DummyRequest([b""]) + html = redirectTo( + b'https://twisted.org/">', request + ) + expected = b""" + + + + + + click here + + +""" + self.assertEqual(html, expected) + class ParentRedirectTests(SynchronousTestCase): """