Conversation
…nment logic to a separate service and add tests for account context assignment
…ontext processors, and streamline event switching functionality
- Deleted the old join_view_test.py file. - Created a new test file test_join_view.py with comprehensive test cases for the exhibitor join view. - Added tests for handling anonymous users, unknown event slugs, incomplete profiles, and existing submissions. - Mocked template rendering and user profile checks to ensure proper response handling. - Updated dependencies in uv.lock to include coverage, pytest, pytest-cov, and pytest-django for improved testing capabilities.
… comprehensive tests
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| _set_event_session(request, event) | ||
| messages.success(request, f'Event gewechselt zu: {event.name}') | ||
| return redirect('crm_user_home') | ||
| return redirect(_get_redirect_path(request, event)) |
Check warning
Code scanning / CodeQL
URL redirection from remote source
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
In general, to fix untrusted URL redirection you should ensure that any user-provided redirect target is either (a) selected from a server-maintained whitelist, or (b) constrained to safe forms such as same-site relative paths and validated with a trusted helper. In this code, the main remaining risk (and what CodeQL flags) is that next_path can be an absolute URL on the same host, which is allowed by url_has_allowed_host_and_scheme but not strictly necessary here. Tightening _get_safe_next_path so that it only returns relative URLs (no scheme/host) will both harden security and make the dataflow obviously safe.
Concretely, the best minimal fix without changing higher-level behavior is:
- In
_get_safe_next_path, after confirming withurl_has_allowed_host_and_scheme, parsenext_pathwithurllib.parse.urlparse. - If the parsed value has any
schemeornetloc, treat it as unsafe and returnNone; otherwise, it is a relative path and safe to use. - Keep the existing
url_has_allowed_host_and_schemecall as an additional safeguard (e.g., for odd encodings, backslashes, etc.), but ensure the function only returns paths relative to the current host. - Since this file already imports Django’s helper and standard library
urlparseis not yet imported, add an import forurlparsefromurllib.parseat the top ofswitch_event.py.
No changes are needed in event_lookup.py: it only manipulates path segments and does not introduce new host/scheme information. The only edits are in src/rockon/base/views/switch_event.py: add the urlparse import and extend _get_safe_next_path to reject any absolute URLs.
| @@ -1,5 +1,7 @@ | ||
| from __future__ import annotations | ||
|
|
||
| from urllib.parse import urlparse | ||
|
|
||
| from django.contrib import messages | ||
| from django.contrib.auth.decorators import login_required | ||
| from django.shortcuts import redirect | ||
| @@ -72,4 +74,9 @@ | ||
| ): | ||
| return None | ||
|
|
||
| parsed = urlparse(next_path) | ||
| # Only allow relative paths without an explicit scheme or host | ||
| if parsed.scheme or parsed.netloc: | ||
| return None | ||
|
|
||
| return next_path |
1 participant
No description provided.