mitsuhiko/flask — pull request #829 by DasIch (2013-08-09 18:03:28+00:00)
Title: Making redirecting safe / Deprecating redirects to 3rd party hosts

This PR adds a `safe_hosts` parameter to `redirect`, which allows defining a safe set of hosts to redirect to and issues a `DeprecationWarning`, if `redirect` is used to redirect to a different host than the one of the application or defined in `safe_hosts`. In the future instead of a `DeprecationWarning` being issued, an exception should be raised.

The purpose of this change is to prevent [unvalidated redirects](https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards), which is currently listed among the Top 10 of the most common web application vulnerabilities by OWASP and was recently mentioned by [Jacob Kaplan-Moss at a talk at PyCon Australia](https://www.youtube.com/watch?v=sra9x44lXgU). It's also an easy way to improve our results in comparisions like these ;)