Merge branch 'main' into issue-OWASP-BLT#1346

JisanAR03 · Oct 28, 2023 · 594c40e · 594c40e
2 parents d3df289 + de6d695
commit 594c40e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/website/views.py b/website/views.py
@@ -168,8 +168,12 @@ def index(request, template="index.html"):
 
 
 def github_callback(request):
+    ALLOWED_HOSTS = ['github.com']
     params = urllib.parse.urlencode(request.GET)
-    return redirect(f"{settings.CALLBACK_URL_FOR_GITHUB}?{params}")
+    url = f"{settings.CALLBACK_URL_FOR_GITHUB}?{params}"
+    parsed_url = urlparse(url)
+    if parsed_url.netloc in ALLOWED_HOSTS:
+        return redirect(url)
 
 
 def google_callback(request):