Prevent external redirects

bookmarks/utils.py

@@ -1,3 +1,4 @@
+import re
 from datetime import datetime
 from typing import Optional
 
@@ -99,6 +100,6 @@ def parse_timestamp(value: str):
 
 def get_safe_return_url(return_url: str, fallback_url: str):
     # Use fallback if URL is none or URL is not on same domain
-    if not return_url or not return_url.startswith('/'):
+    if not return_url or not re.match(r'^/[a-z]+', return_url):
         return fallback_url
     return return_url