From 5fda61f2714f1f1dd4baf4486c08d08010a4262d Mon Sep 17 00:00:00 2001 From: Erica Portnoy Date: Thu, 29 Sep 2016 15:31:13 -0700 Subject: [PATCH] Allow validation of cross-domain redirects (#3561) * Update compatibility validator to pass redirect check when redirecting to a different domain, whether http or https. --- .../certbot_compatibility_test/validator.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/certbot-compatibility-test/certbot_compatibility_test/validator.py b/certbot-compatibility-test/certbot_compatibility_test/validator.py index e82b2c049..333b47296 100644 --- a/certbot-compatibility-test/certbot_compatibility_test/validator.py +++ b/certbot-compatibility-test/certbot_compatibility_test/validator.py @@ -40,8 +40,15 @@ class Validator(object): return False redirect_location = response.headers.get("location", "") + # We're checking that the redirect we added behaves correctly. + # It's okay for some server configuration to redirect to an + # http URL, as long as it's on some other domain. if not redirect_location.startswith("https://"): - return False + if not redirect_location.startswith("http://"): + return False + else: + if redirect_location[len("http://"):] == name: + return False if response.status_code != 301: logger.error("Server did not redirect with permanent code")