zopefoundation / Zope / 6245763548 / 1

81%

master: 82%

push

github

Tighten down the ZMI frame source logic to only allow site-local sources. (#1160)

Do the logic in new method `getZMIMainFrameTarget`.
Do not accept a 'tainted' came_from parameter.
Do not accept a came_from path-only url starting with '//' either.
Browsers can interpret the rest of the path as a domain.

Co-authored-by: Jens Vagelpohl <jens@plyp.com>

4341 of 7076 branches covered (0.0%)

Branch coverage included in aggregate %.

27211 of 31806 relevant lines covered (85.55%)

0.86 hits per line