Skip to content

Commit

Permalink
Add URLvalidator to validate in admin widget
Browse files Browse the repository at this point in the history
This is the same method that was introduced for CVE-2019-12308:
AdminURLFieldWidgetXSS.
  • Loading branch information
kalzun authored and aleksihakli committed Sep 28, 2022
1 parent 7fb80a5 commit 83f61bd
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion embed_video/admin.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
from django import forms
from django.core.validators import URLValidator
from django.core.exceptions import ValidationError
from django.utils.safestring import mark_safe

from embed_video.backends import (
Expand Down Expand Up @@ -33,6 +35,7 @@ def __init__(self, attrs=None):
:type attrs: dict
"""
default_attrs = {"size": "40"}
self.validator = URLValidator()

if attrs:
default_attrs.update(attrs)
Expand All @@ -51,13 +54,14 @@ def render(self, name, value="", attrs=None, size=(420, 315), renderer=None):
return output

try:
self.validator(value)
backend = detect_backend(value)
return mark_safe(
self.output_format.format(
video=backend.get_embed_code(*size), input=output
)
)
except (UnknownBackendException, VideoDoesntExistException):
except (UnknownBackendException, ValidationError, VideoDoesntExistException):
return output


Expand Down

0 comments on commit 83f61bd

Please sign in to comment.