Impact
Deployed instances of Datasette prior to 0.65.2 and 1.0a21 include an open redirect vulnerability.
Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar.
Patches
This problem has been patched in both Datasette 0.65.2 and 1.0a21.
Workarounds
If Datasette is running behind a proxy that proxy could be configured to replace // with / in incoming request URLs.
References
#2429
jamesjefferies Remediation developer
Impact
Deployed instances of Datasette prior to
0.65.2and1.0a21include an open redirect vulnerability.Hits to the path
//example.com/foo/bar/(the trailing slash is required) will redirect the user tohttps://example.com/foo/bar.Patches
This problem has been patched in both Datasette
0.65.2and1.0a21.Workarounds
If Datasette is running behind a proxy that proxy could be configured to replace
//with/in incoming request URLs.References
#2429