speakr

v0.8.20-alpha — Security: open-redirect fix in is_safe_url

Security patch release on top of v0.8.19-alpha.

Fixed

• Open redirect via the next parameter (CWE-601). The is_safe_url() helper validated urljoin(request.host_url, target) while redirect() was called with the raw target. A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where browsers interpret it as a network-path-relative redirect to an attacker-controlled host. is_safe_url() now validates the raw target against a local-path allowlist: leading / required, scheme-relative URLs (//, /\), backslashes, control characters, and any value that produces a scheme or netloc when parsed are rejected. The duplicate copy in src/api/auth.py was removed; password login and the SSO next / callback flow share one validator. Regression tests in tests/test_open_redirect.py.

  Reported by RacerZ and Fushuling. Tracked as a GitHub Security Advisory; CVE pending.

Tests

• New tests/test_open_redirect.py — 7 cases covering scheme-relative URLs, absolute URLs, backslash variants, javascript: / data: schemes, CRLF/control-character injection, missing leading slash, and accepted local paths.
• tests/test_transcription_model_override.py — pre-existing env-bleed flake fixed; the helper now isolates the call from any admin-saved transcription_default_model SystemSetting that may exist in a dev DB. 275 backend tests passing.

No new features, no breaking changes

Upgrade is the usual docker compose pull && docker compose up -d. Users on v0.8.19-alpha or earlier should upgrade promptly; the workaround for those who cannot is to front Speakr with a reverse proxy that strips next query parameters on the /login route, or block requests where next starts with //, \\, or contains a scheme.