Skip to content

Commit e349e67

Browse files
Zircozclaude
andcommitted
[Confluence] Fix CodeQL incomplete URL substring sanitization
Use urlparse to extract and check the hostname directly instead of naive substring matching, preventing spoofing via paths like evil.com/atlassian.net/... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 09af08a commit e349e67

1 file changed

Lines changed: 8 additions & 1 deletion

File tree

atlassian/confluence/__init__.py

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
This package provides both Cloud and Server implementations of the Confluence API.
66
"""
77

8+
from urllib.parse import urlparse
9+
810
from .cloud import Cloud as ConfluenceCloud
911
from .server import Server as ConfluenceServer
1012

@@ -21,7 +23,12 @@ def __init__(self, url, *args, **kwargs):
2123
# Priority: explicit cloud= kwarg > URL-based heuristic
2224
is_cloud = kwargs.get("cloud")
2325
if is_cloud is None:
24-
is_cloud = "atlassian.net" in url or "jira.com" in url or "api.atlassian.com" in url
26+
hostname = urlparse(url).hostname or ""
27+
is_cloud = (
28+
hostname == "atlassian.net" or hostname.endswith(".atlassian.net")
29+
or hostname == "jira.com" or hostname.endswith(".jira.com")
30+
or hostname == "api.atlassian.com" or hostname.endswith(".api.atlassian.com")
31+
)
2532
if is_cloud:
2633
impl = ConfluenceCloud(url, *args, **kwargs)
2734
else:

0 commit comments

Comments
 (0)