fix(security): sanitize redirect URLs after altcha validation

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/middleware/altcha_protection.py

@@ -15,19 +15,20 @@
 
 SESSION_TIMEOUT = 900  # 15 minutes
 
+ALTCHA_PROTECTED_PREFIXES = (
+    "/packages/",
+    "/vulnerabilities/",
+    "/advisories/",
+    "/affected-by-advisories/v2/",
+    "/fixing-advisories/v2/",
+    "/pipelines/",
+)
+
 
 class AltchaProtectionMiddleware(MiddlewareMixin):
-    PROTECTED_PREFIXES = (
-        "/packages/",
-        "/vulnerabilities/",
-        "/advisories/",
-        "/affected-by-advisories/v2/",
-        "/fixing-advisories/v2/",
-        "/pipelines/",
-    )
 
     def __call__(self, request):
-        protected = any(request.path.startswith(prefix) for prefix in self.PROTECTED_PREFIXES)
+        protected = any(request.path.startswith(prefix) for prefix in ALTCHA_PROTECTED_PREFIXES)
 
         if not protected:
             return self.get_response(request)

vulnerabilities/utils.py

@@ -20,12 +20,11 @@
 from functools import total_ordering
 from http import HTTPStatus
 from typing import List
-from typing import NamedTuple
 from typing import Optional
-from typing import Set
 from typing import Tuple
 from typing import Union
 from unittest.mock import MagicMock
+from urllib.parse import unquote
 from urllib.parse import urljoin
 
 import dateparser
@@ -36,6 +35,8 @@
 from cwe2.database import Database
 from cwe2.database import InvalidCWEError
 from django.db.models import Prefetch
+from django.shortcuts import redirect
+from django.utils.http import url_has_allowed_host_and_scheme
 from packageurl import PackageURL
 from packageurl.contrib.django.utils import without_empty_values
 from univers.version_range import RANGE_CLASS_BY_SCHEMES
@@ -44,6 +45,7 @@
 from univers.version_range import VersionRange
 
 from aboutcode.hashid import build_vcid
+from vulnerabilities.middleware.altcha_protection import ALTCHA_PROTECTED_PREFIXES
 
 logger = logging.getLogger(__name__)
 
@@ -1114,3 +1116,16 @@ def build_alias_to_advisory_map(aliases_strs):
     ):
         alias_to_advisories[advisory.advisory_id].add(advisory)
     return alias_to_advisories
+
+
+def safe_altcha_redirect(next_url: str) -> redirect:
+    """Safely redirect to ALTCHA protected URL, block external URLs."""
+    is_safe = url_has_allowed_host_and_scheme(url=next_url, allowed_hosts=None, require_https=False)
+
+    decoded_url = unquote(next_url) if next_url else ""
+    is_protected = any(decoded_url.startswith(prefix) for prefix in ALTCHA_PROTECTED_PREFIXES)
+
+    if is_safe and is_protected:
+        return redirect(next_url)
+
+    return redirect("/")

vulnerabilities/views.py

@@ -16,7 +16,6 @@
 from cvss.exceptions import CVSS2MalformedError
 from cvss.exceptions import CVSS3MalformedError
 from cvss.exceptions import CVSS4MalformedError
-from django import forms
 from django.contrib import messages
 from django.contrib.auth.views import LoginView
 from django.core.cache import cache
@@ -29,7 +28,6 @@
 from django.http import HttpResponse
 from django.http.response import Http404
 from django.shortcuts import get_object_or_404
-from django.shortcuts import redirect
 from django.shortcuts import render
 from django.urls import reverse_lazy
 from django.views import View
@@ -38,7 +36,6 @@
 from django.views.generic.edit import FormMixin
 from django.views.generic.edit import FormView
 from django.views.generic.list import ListView
-from django_altcha import AltchaField
 
 from vulnerabilities import models
 from vulnerabilities.forms import AdminLoginForm
@@ -67,6 +64,7 @@
 from vulnerabilities.throttling import AnonUserUIThrottle
 from vulnerabilities.utils import TYPES_WITH_MULTIPLE_IMPORTERS
 from vulnerabilities.utils import get_advisories_from_groups
+from vulnerabilities.utils import safe_altcha_redirect
 from vulnerablecode import __version__ as VULNERABLECODE_VERSION
 from vulnerablecode.settings import env
 
@@ -1173,12 +1171,12 @@ def dispatch(self, request, *args, **kwargs):
         if verified_at:
             if time.time() - verified_at < ALTCHA_SESSION_TIMEOUT:
                 next_url = request.GET.get("next", "/")
-                return redirect(next_url)
+                return safe_altcha_redirect(next_url)
 
         return super().dispatch(request, *args, **kwargs)
 
     def form_valid(self, form):
         self.request.session["altcha_verified_at"] = time.time()
 
         next_url = self.request.GET.get("next", "/")
-        return redirect(next_url)
+        return safe_altcha_redirect(next_url)