vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: tighten allowed referrer checks

Browse source 
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
This commit is contained in:
Akhil Narang 2025-10-15 18:22:12 +05:30
parent fdd464fc14
commit 2fc4778cdd
No known key found for this signature in database
GPG key ID: 9DCC61E211BF645F
2 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
frappe/auth.py
View file

@ -110,9 +110,12 @@ class HTTPRequest:
)
# Check if the referrer or origin is in the allowed list
return (referrer and any(referrer.startswith(allowed) for allowed in allowed_referrers)) or (
origin and any(origin == allowed for allowed in allowed_referrers)
)
if referrer:
referrer_parsed = urlparse(referrer)
if any(referrer_parsed.netloc == urlparse(allowed).netloc for allowed in allowed_referrers):
return True
return origin in allowed_referrers if origin else False
class LoginManager:

14
frappe/tests/test_auth.py
View file

@ -176,8 +176,10 @@ class TestAllowedReferrer(UnitTestCase):
env = builder.get_environ()
return Request(env)
# Test with valid referrer
# Set a single allowed referrer
frappe.cache.set_value("allowed_referrers", ["https://example.com"])
# Test with valid referrer
frappe.local.request = create_request({"Referer": "https://example.com/some/path"})
http_request = frappe.auth.HTTPRequest()
self.assertTrue(http_request.is_allowed_referrer())
@ -197,6 +199,16 @@ class TestAllowedReferrer(UnitTestCase):
http_request = frappe.auth.HTTPRequest()
self.assertFalse(http_request.is_allowed_referrer())
# Test subdomain bypass prevention
frappe.local.request = create_request({"Referer": "https://example.com.evil.com"})
http_request = frappe.auth.HTTPRequest()
self.assertFalse(http_request.is_allowed_referrer())
# Test exact domain match for referrer
frappe.local.request = create_request({"Referer": "https://example.com"})
http_request = frappe.auth.HTTPRequest()
self.assertTrue(http_request.is_allowed_referrer())
# Clean up
frappe.cache.delete_value("allowed_referrers")
frappe.local.request = None