Add sanitize function for redirect parameter next #1401
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change description
Problem: The
next
parameter used with the/login
route is incorrectly decoded, so the redirection happens to the wrong URL. When thenext
parameter contains a + sign, the application encodes it as a space value. For example:...?next=courses/course-v1:snowflake-sandbox+ACC-PTF+C/course
- at the moment of redirection this route will be encoded as...?next=courses/course-v1:snowflake-sandbox%20ACC-PTF%20C/course
where the %20 is encoded space symbol. So, the user will see the 404 page instead of the course page.Fix:
Add the sanitize function which will check the next parameter:
Type of change
Related issues
Checklists
Development
Security
Code review