Daily updates from Odoo
Monday, July 28, 2025
1 change
Security fixes and vulnerability patches
A new shared helper standardizes how web links are combined across several Odoo apps and integrations. This reduces the risk of malformed or manipulated links, helping protect redirects, API calls, and shared URLs without changing everyday user workflows.
Original PR description
This commit adds a default odoo url joining helper function that basically does the same as base.rstrip('/') + '/' + url.lstrip('/'), but with schema, hostname, path traversal and better fragments/query handling.
Most url parsing libraries like urllib and werkzeug (at least try to) follow RFC 3986 which explains in detail how to do relative resolutions. But developers usually expect simple concatenation behaviour like "api.example.com/v1/" + endpoint, but by passing a user-controlled data to urljoin, they end up giving room for people to tinker with things nobody ever expected were possible, which can lead to some nasty stuff. So the motivation here is to give a function that is somewhat better aligned with what devs expect it to do.
Community: https://github.com/odoo/odoo/pull/219623
task-3792184