The re_path has no ^ anchor and doesn't capture the proxied path, which forces:
path = request.get_full_path().split("proxy/")[1]
That takes the wrong segment for any URL containing proxy/ twice. Capture (?P<path>.*) in the route and take it as a view argument — the SSRF guards below it (views.py:308-329) get easier to reason about when the input isn't reverse-engineered from the URL.
Sites: views.py:304, urls.py:22
(from #1780)
The
re_pathhas no^anchor and doesn't capture the proxied path, which forces:That takes the wrong segment for any URL containing
proxy/twice. Capture(?P<path>.*)in the route and take it as a view argument — the SSRF guards below it (views.py:308-329) get easier to reason about when the input isn't reverse-engineered from the URL.Sites:
views.py:304,urls.py:22(from #1780)