[tahoe-lafs-trac-stream] [tahoe-lafs] #1861: redirects in tahoe should not point to other origins

[tahoe-lafs]

#1861: redirects in tahoe should not point to other origins
-------------------------+----------------------------
 Reporter:  ChosenOne    |          Owner:  davidsarah
     Type:  enhancement  |         Status:  new
 Priority:  normal       |      Milestone:  undecided
Component:  unknown      |        Version:  1.9.2
 Keywords:               |  Launchpad Bug:
-------------------------+----------------------------
 From what I see in unlinked.py (https://tahoe-lafs.org/trac/tahoe-
 lafs/browser/trunk/src/allmydata/web/unlinked.py), most redirects could be
 filtered to only start with the protocol, domain and port of the web UI. I
 suppose this is non-trivial, but might be extracted from the HTTP
 request's Host header

 The current redirection does not pose a severe risk, but it might at least
 prevent social engineering attacks in which a URL that starts with the
 tahoe's gw address wounds up on a completely different web page.

-- 
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1861>
tahoe-lafs <https://tahoe-lafs.org>
secure decentralized storage