Fix open redirect vulnerability in URL shortener via backslash bypass

[Copilot]

The URL shortener's follow() view was vulnerable to open redirect attacks. While a lstrip('/') guard prevented //evil.com protocol-relative redirects, a backslash bypass remained: storing \evil.com produces a redirect to /\evil.com, which some browsers normalize to //evil.com, redirecting to an external domain.

Changes

• url_shortener/views.py: Added url_has_allowed_host_and_scheme() validation after URL construction. If the resulting URL fails the safety check, falls back to the browser root.

url = browser_url + link.url.lstrip('/')
if not url_has_allowed_host_and_scheme(url=url, allowed_hosts={request.get_host()}):
    url = browser_url

• tests/test_url_shortener.py: Added test_follow_open_redirect_backslash_prevention covering the \evil.com bypass case, asserting the redirect passes url_has_allowed_host_and_scheme against testserver.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.