Skip to content

Commit 624d6c0

Browse files
dlqqqCarreau
authored andcommitted
Delete outdated patch code
1 parent d825b93 commit 624d6c0

1 file changed

Lines changed: 0 additions & 8 deletions

File tree

jupyter_server/auth/login.py

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,6 @@ def _redirect_safe(self, url, default=None):
4444
# instead of %5C, causing `\\` to behave as `//`
4545
url = url.replace("\\", "%5C")
4646

47-
# Prevent open redirect attacks by blocking URLs that start with //
48-
# These are protocol-relative URLs that can redirect to external sites
49-
if url.startswith("//"):
50-
self.log.warning("Not allowing login redirect to protocol-relative URL %r" % url)
51-
url = default
52-
self.redirect(url)
53-
return
54-
5547
# urllib and browsers interpret extra '/' in the scheme separator (`scheme:///host/path`)
5648
# differently.
5749
# urllib gives scheme=scheme, netloc='', path='/host/path', while

0 commit comments

Comments
 (0)