Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
go
go
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 21
    • Issues 21
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 0
    • Merge Requests 0
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Members
    • Members
  • Collapse sidebar
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
  • SRCT
  • gogo
  • Issues
  • #108

Closed
Open
Opened Dec 18, 2016 by David Haynes@dhaynes3🙆Owner
  • Report abuse
  • New issue
Report abuse New issue

Do not render Go links to itself

Summary

Currently Go prevents users from creating Go links to Go. However, this can be easily bypassed by making a link (say a bitly) that then redirects to Go. At the views.py level we need to check if we are redirecting users to a Go link, and if so, then throw a 500 error. I had thought this was implemented already but this is still exploitable.

Helpful Links

  • https://git.gmu.edu/srct/go/blob/master/go/go/views.py#L269
Assignee
Assign to
Go 2.2 - Bloomin' Onion Edition
Milestone
Go 2.2 - Bloomin' Onion Edition (Past due)
Assign milestone
Time tracking
None
Due date
None
Reference: srct/go#108