Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The function
is_safe_url
inprivaterelay.allauth.AccountAdapter
checks if the provided next URL is safe. This was recently customized, but is broken.For example, this URL:
https://stage.fxprivaterelay.nonprod.cloudops.mozgcp.net/accounts/fxa/login/?next=profile_refresh
will redirect the user after login to:
https://stage.fxprivaterelay.nonprod.cloudops.mozgcp.net/accounts/fxa/login/profile_refresh
Most URLs are not URL names, so most URLs will be identified as non-safe, and the user will redirect to
/accounts/profile/?
.This PR fixes the function and improves it so that it will also redirect to next.js pages. Some things to try:
This issue was re-discovered while working on MPP-3698, which failed type checking with
mypy --check-untyped-defs privaterelay/allauth.py
. It now passes.