瀏覽代碼

HUE-5297 [beeswax] fixing Open redirect vulnerability in on_success_url

Prakash Ranade 9 年之前
父節點
當前提交
0f3f79ff65
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      apps/beeswax/src/beeswax/views.py

+ 2 - 1
apps/beeswax/src/beeswax/views.py

@@ -32,6 +32,7 @@ from django.utils.translation import ugettext as _
 from django.core.urlresolvers import reverse
 
 from desktop.appmanager import get_apps_dict
+from desktop.conf import REDIRECT_WHITELIST
 from desktop.context_processors import get_app_name
 from desktop.lib.paginator import Paginator
 from desktop.lib.django_util import JsonResponse
@@ -400,7 +401,7 @@ def execute_query(request, design_id=None, query_history_id=None):
         handle, state = _get_query_handle_and_state(query_history)
 
       if 'on_success_url' in request.GET:
-        if request.GET.get('on_success_url'):
+        if request.GET.get('on_success_url') and any([regexp.match(request.GET.get('on_success_url')) for regexp in REDIRECT_WHITELIST.get()]):
           action = 'watch-redirect'
         else:
           action = 'watch-results'