Found by Codex during review of #1209 (pre-existing, not introduced there).
FeedbackForm.page is an unrestricted hidden CharField whose value is emitted after submission as <a href="{{ page }}"> (the 'go back' link). A crafted /feedback/?page=javascript:... or off-site URL becomes that link's target. Django autoescaping protects HTML syntax but not unsafe URL schemes.
Suggested fix: validate the submitted value as a same-site http(s) URL (or better, store only a same-site path) and fall back to / otherwise.
Low severity (requires the victim to click the crafted link and then the 'go back' link), but cheap to fix and adjacent to the #1209 hardening.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CZoSkYdkKLH37tH4QbEmH7
Found by Codex during review of #1209 (pre-existing, not introduced there).
FeedbackForm.pageis an unrestricted hidden CharField whose value is emitted after submission as<a href="{{ page }}">(the 'go back' link). A crafted/feedback/?page=javascript:...or off-site URL becomes that link's target. Django autoescaping protects HTML syntax but not unsafe URL schemes.Suggested fix: validate the submitted value as a same-site http(s) URL (or better, store only a same-site path) and fall back to
/otherwise.Low severity (requires the victim to click the crafted link and then the 'go back' link), but cheap to fix and adjacent to the #1209 hardening.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CZoSkYdkKLH37tH4QbEmH7