#5127 - Prevent open redirects via the OIDC next redirect parameter (sm) (#5139)

Author: smishraECS

src/djangooidc/tests/test_views.py

@@ -542,3 +542,14 @@ def test_logout_callback_redirects(self, _):
             # ASSERTIONS
             self.assertEqual(response.status_code, 302)
             self.assertEqual(response.url, reverse("logout"))
+
+    def test_external_redirect_login(self, mock_client):
+        with less_console_noise():
+            # Testing with an invalid callback url
+            callback_url = "http://www.google.com"
+            mock_client.create_authn_request.side_effect = self.say_hi
+            mock_client.get_default_acr_value.side_effect = self.create_acr
+            response = self.client.get(reverse("login"), {"next": callback_url})
+            session = mock_client.create_authn_request.call_args[0][0]
+            self.assertEqual(session["next"], "/")
+            self.assertEqual(response.status_code, 200)

src/djangooidc/views.py

@@ -7,6 +7,7 @@
 from django.contrib.auth import logout as auth_logout
 from django.contrib.auth import authenticate, login
 from django.http import HttpResponseRedirect
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.shortcuts import redirect
 from urllib.parse import parse_qs, urlencode
 
@@ -76,7 +77,11 @@ def openid(request):
             logger.debug("OIDC client is None, attempting to initialize")
             _initialize_client()
         request.session["acr_value"] = CLIENT.get_default_acr_value()
-        request.session["next"] = request.GET.get("next", "/")
+        if url_has_allowed_host_and_scheme(request.GET.get("next", "/"), None):
+            request.session["next"] = request.GET.get("next", "/")
+        else:
+            logger.warning(f"Invalid redirect: {request.GET.get("next")}")
+            request.session["next"] = "/"
         # Create the authentication request
         return CLIENT.create_authn_request(request.session)
     except Exception as err:
@@ -135,7 +140,11 @@ def login_callback(request):
             # In the event of a state mismatch between OP and session, redirect the user to the
             # beginning of login process without raising an error to the user. Attempt once.
             logger.warning(f"No State Defined: {nsd_err}")
-            return redirect(request.session.get("next", "/"))
+            if url_has_allowed_host_and_scheme(request.GET.get("next", "/"), None):
+                return redirect(request.session.get("next", "/"))
+            else:
+                logger.warning(f"Invalid redirect: {request.GET.get("next")}")
+                return redirect("/")
         else:
             # Clear the flag if the exception is not caught
             request.session.pop("redirect_attempted", None)