Merge pull request #360 from gbrownmozilla/redirects

[Bug 1753838] Harden trailing slashes redirect

pollbot/middlewares.py

@@ -1,6 +1,7 @@
 import logging
 from aiohttp import web
 import os
+import string
 
 logger = logging.getLogger(__package__)
 
@@ -60,8 +61,12 @@ async def handle_any(request, response):
 
 async def handle_404(request, response):
     if 'json' not in response.headers['Content-Type']:
+        # This traling slash redirect has caused security issues.
+        # If it continues to be problematic, consider:
+        #  - only redirect "/v1/.../"?
+        #  - remove the redirect entirely; use duplicate routes instead, in app.py
         if request.path.endswith('/'):
-            return web.HTTPFound('/' + request.path.strip('/'))
+            return web.HTTPFound('/' + request.path.strip('/'+string.whitespace))
         return web.json_response({
             "status": 404,
             "message": "Page '{}' not found".format(request.path)

tests/test_views.py

@@ -65,6 +65,12 @@ async def test_redirects_strip_leading_slashes(cli):
     cli.server.skip_url_asserts = True
     resp = await check_response(cli, "//page/", status=302, allow_redirects=False)
     assert resp.headers['Location'] == "/page"
+    # also strip leading and trailing whitespace
+    resp = await check_response(cli, "/%0a/www.evil.com/", status=302, allow_redirects=False)
+    assert resp.headers['Location'] == "/www.evil.com"
+    resp = await check_response(cli, "/%0a /www.evil.com %0a%0b/", status=302,
+                                allow_redirects=False)
+    assert resp.headers['Location'] == "/www.evil.com"
 
 
 async def check_yaml_resource(cli, url, filename, **kwargs):