From 124103743e56800f949e01f5b339e499c266ea55 Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Fri, 28 Aug 2026 16:28:13 +0530 Subject: [PATCH] [INFRA-779] use str.translate instead of a char-by-char rebuild for tab/CR/LF stripping Address /code-review cleanup finding, following the same fix applied to the plane-ee port (INFRA-780): single-pass str.translate is shorter and matches the terse style of the adjacent .replace("\\", "") line. Also verified, and declining, the review's other finding on the EE port (delegate to Django's url_has_allowed_host_and_scheme instead of hand-rolling the "//" check): Django's own _url_has_allowed_host_and_scheme does not strip tab/CR/LF before its startswith("///") check either, so it would reintroduce the exact bypass this PR fixed, and validate_next_path also does path-traversal/suspicious-pattern checks Django's helper doesn't attempt at all. Co-authored-by: Plane AI --- apps/api/plane/utils/path_validator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/api/plane/utils/path_validator.py b/apps/api/plane/utils/path_validator.py index b59daab859..ac7a231d03 100644 --- a/apps/api/plane/utils/path_validator.py +++ b/apps/api/plane/utils/path_validator.py @@ -120,7 +120,7 @@ def validate_next_path(next_path: str) -> str: # scheme-free string here and a literal .startswith("//") below would # miss it too (the second character is a tab, not a slash). Strip them # here so every check downstream sees what the browser will. - next_path = "".join(char for char in next_path if char not in "\t\r\n") + next_path = next_path.translate(str.maketrans("", "", "\t\r\n")) parsed_url = urlparse(next_path)