Description: Malformed URLs from user input incorrectly validated (CVE-2014-3730)
 The validation for redirects did not correctly validate some malformed
 URLs, which are accepted by some browsers. This allows a user to be
 redirected to an unsafe URL unexpectedly.
 .
 Django relies on user input in some cases (e.g.
 django.contrib.auth.views.login, django.contrib.comments, and i18n) to
 redirect the user to an "on success" URL. The security checks for these
 redirects (namely django.util.http.is_safe_url()) did not correctly
 validate some malformed URLs, such as http:\\\djangoproject.com, which
 are accepted by some browsers with more liberal URL parsing.
 .
 To remedy this, the validation in is_safe_url() has been tightened to
 be able to handle and correctly validate these malformed URLs.
Origin: backport, https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df
Author: Salvatore Bonaccorso <carnil@debian.org>
Last-Update: 2014-05-18

---
 django/contrib/auth/tests/views.py |    2 ++
 django/utils/http.py               |   12 ++++++++++++
 2 files changed, 14 insertions(+)

--- a/django/utils/http.py
+++ b/django/utils/http.py
@@ -132,7 +132,19 @@ def is_safe_url(url, host=None):
     """
     if not url:
         return False
+    # Chrome treats \ completely as /
+    url = url.replace('\\', '/')
+    # Chrome considers any URL with more than two slashes to be absolute, but
+    # urlaprse is not so flexible. Treat any url with three slashes as unsafe.
+    if url.startswith('///'):
+        return False
     url_info = urlparse.urlparse(url)
+    # Forbid URLs like http:///example.com - with a scheme, but without a hostname.
+    # In that URL, example.com is not the hostname but, a path component. However,
+    # Chrome will still consider example.com to be the hostname, so we must not
+    # allow this syntax.
+    if not url_info[1] and url_info[0]:
+        return False
     return (not url_info[1] or url_info[1] == host) and \
         (not url_info[0] or url_info[0] in ['http', 'https'])
 
--- a/django/contrib/auth/tests/views.py
+++ b/django/contrib/auth/tests/views.py
@@ -229,8 +229,10 @@ class LoginTest(AuthViewsTestCase):
 
         # Those URLs should not pass the security check
         for bad_url in ('http://example.com',
+                        'http:///example.com',
                         'https://example.com',
                         'ftp://exampel.com',
+                        '///example.com',
                         '//example.com',
                         'javascript:alert("XSS")'):