Resolved ssrf vulnerability #2657
Conversation
🔍 Existing Issues For ReviewYour pull request is modifying functions with the following pre-existing issues: 📄 File: website/views.py
Did you find this useful? React with a 👍 or 👎 |
| company_name = request.POST.get("company") | ||
| company = Company.objects.filter(name=company_name).first() | ||
|
|
||
| if not company: | ||
| try: |
There was a problem hiding this comment.
This is very basic check for company name in the response body. Let's at least check that the request isn't being redirected to another location (status code 200 might work)
There was a problem hiding this comment.
I have made the changes, plz do check if this satisfies the requirements. Thank you.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # back to the domain detail page | ||
| return redirect("domain", slug=domain.url) | ||
| try: | ||
| response = requests.get(domain.url, allow_redirects=False) |
Check failure
Code scanning / CodeQL
Full server-side request forgery Critical
|
can you please fix the conflicts? |
On It. Will try to fix this asap. |
|
We split this file up |
PR Desc:
This pr is regarding the issue in the server-side request forgery vulnerability. This pr aims to fix #2650 .