Fix code scanning alert issue-#1338 (#1502)

Co-authored-by: DonnieBLT <128622481+DonnieBLT@users.noreply.github.com>
OWASP-BLT · Oct 28, 2023 · de6d695 · de6d695
1 parent f869d90
commit de6d695
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/website/views.py b/website/views.py
@@ -168,8 +168,12 @@ def index(request, template="index.html"):
 
 
 def github_callback(request):
+    ALLOWED_HOSTS = ['github.com']
     params = urllib.parse.urlencode(request.GET)
-    return redirect(f"{settings.CALLBACK_URL_FOR_GITHUB}?{params}")
+    url = f"{settings.CALLBACK_URL_FOR_GITHUB}?{params}"
+    parsed_url = urlparse(url)
+    if parsed_url.netloc in ALLOWED_HOSTS:
+        return redirect(url)
 
 
 def google_callback(request):