diff mbox series

[error-report-web,3/3] Add and use safe_url tag to prevent rendering of insecure link back URLs.

Message ID 20261008150446.74259-3-piotr@qbee.io
State New
Headers show
Series [error-report-web,1/3] Fix existing tests to establish a know working baseline for future work. | expand

Commit Message

Piotr Buliński Oct. 8, 2026, 3:04 p.m. UTC 
Signed-off-by: Piotr Buliński <piotr@qbee.io>
---
 Post/templatetags/projecttags.py | 5 +++++
 templates/error-details.html     | 3 ++-
 2 files changed, 7 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/Post/templatetags/projecttags.py b/Post/templatetags/projecttags.py
index 6c5ed94..a01989f 100644
--- a/Post/templatetags/projecttags.py
+++ b/Post/templatetags/projecttags.py
@@ -3,9 +3,14 @@  import re
 from django import template
 from django.utils import timezone
 from django.template.defaultfilters import filesizeformat
+from Post.validators import clean_link_back
 
 register = template.Library()
 
+@register.filter(name = 'safe_url')
+def safe_url(value):
+    return clean_link_back(value) or ''
+
 @register.filter(name = 'sortcols')
 def sortcols(tablecols):
     return sorted(tablecols, key = lambda t: t['name'])
diff --git a/templates/error-details.html b/templates/error-details.html
index 35bf0aa..5aa807d 100644
--- a/templates/error-details.html
+++ b/templates/error-details.html
@@ -1,4 +1,5 @@ 
 {% extends "base.html" %}
+{% load projecttags %}
 {% block content %}
 <div class="row-fluid">
 
@@ -67,7 +68,7 @@ 
 
         {% if detail.BUILD.LINK_BACK %}
         <dt>Link back:</dt>
-        <dd><a href="{{detail.BUILD.LINK_BACK}}" target="_blank">{{detail.BUILD.LINK_BACK}}</a></dd>
+        <dd><a href="{{detail.BUILD.LINK_BACK|safe_url}}" target="_blank" rel="nofollow noopener noreferrer">{{detail.BUILD.LINK_BACK}}</a></dd>
         {% endif %}
 
         <dt></a>Similar errors:</dt>