Reject protocol-relative URLs in post-login redirect

app/controllers/login.py

@@ -90,9 +90,13 @@ def login_post():
             flash('Login successful!', FLASH_SUCCESS)
 
             # Retrieve and clear the redirect from session
-            # Only allow relative URLs to prevent redirecting to external sites
+            # Only allow relative URLs to prevent redirecting to external sites.
+            # '//evil.com' and '\\evil.com' also start with '/', and browsers
+            # happily resolve them as other hosts. wonderful spec behavior.
             redirect_url = session.pop('login_redirect', '/')
-            if not redirect_url.startswith('/'):
+            if (not redirect_url.startswith('/')
+                    or redirect_url.startswith('//')
+                    or '\\' in redirect_url):
                 redirect_url = '/'
             return redirect(redirect_url)
         else:

tests/test_controller_edge_cases.py

@@ -24,6 +24,18 @@ def test_login_does_not_redirect_to_external_referrer(client, alice):
     assert response.location == '/'
 
 
+@pytest.mark.parametrize('referrer', [
+    'http://localhost//evil.example',
+    'http://localhost/\\evil.example',
+])
+def test_login_does_not_redirect_to_protocol_relative_referrer(client, alice, referrer):
+    client.get('/login', headers={'Referer': referrer})
+    response = client.post('/login', data={
+        'name': 'alice', 'password': 'alice-password',
+    })
+    assert response.location == '/'
+
+
 def test_login_missing_and_invalid_name(client):
     missing = client.post('/login', data={'name': '', 'password': ''})
     invalid = client.post('/login', data={'name': '<script>', 'password': 'x'})