mirror of
https://github.com/getredash/redash.git
synced 2025-12-19 17:37:19 -05:00
Incomplete URL substring sanitization (#6342)
* Incomplete URL substring sanitization * fix hostname * Only match on the exact host name --------- Co-authored-by: Justin Clift <justin@postgresql.org>
This commit is contained in:
committed by
GitHub
parent
acf77f85ff
commit
0d1ce4d98c
@@ -3,6 +3,7 @@ import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
from urllib.parse import urlparse
|
||||
|
||||
import requests
|
||||
import simplejson
|
||||
@@ -13,7 +14,7 @@ repo = "getredash/redash"
|
||||
|
||||
|
||||
def _github_request(method, path, params=None, headers={}):
|
||||
if not path.startswith("https://api.github.com"):
|
||||
if urlparse(path).hostname != "api.github.com":
|
||||
url = "https://api.github.com/{}".format(path)
|
||||
else:
|
||||
url = path
|
||||
|
||||
Reference in New Issue
Block a user