Continued:

[fba.git] / fba / csrf.py

diff --git a/fba/csrf.py b/fba/csrf.py
index e68fcb63ef0ee25eebafcb09fc39afca50957e9a..f529af35017c469cb860e20ed0308cb2a01edf78 100644 (file)
--- a/fba/csrf.py
+++ b/fba/csrf.py
@@ -18,6 +18,7 @@ import logging
 
 import bs4
 import reqto
+import requests
 
 from fba.helpers import config
 from fba.helpers import cookies
@@ -25,6 +26,8 @@ from fba.helpers import domain as domain_helper
 
 from fba.http import network
 
+from fba.models import instances
+
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger(__name__)
 
@@ -33,7 +36,7 @@ def determine(domain: str, headers: dict) -> dict:
     domain_helper.raise_on(domain)
 
     if not isinstance(headers, dict):
-        raise ValueError(f"Parameter headers[]='{type(headers)}' is not 'dict'")
+        raise ValueError(f"Parameter headers[]='{type(headers)}' is not of type 'dict'")
 
     # Default headers with no CSRF
     reqheaders = headers
@@ -47,7 +50,7 @@ def determine(domain: str, headers: dict) -> dict:
     )
 
     logger.debug("response.ok='%s',response.status_code=%d,response.text()=%d", response.ok, response.status_code, len(response.text))
-    if response.ok and response.status_code < 300 and response.text != "" and response.text.find("<html") > 0:
+    if response.ok and response.status_code < 300 and response.text.strip() != "" and response.text.find("<html") > 0 and domain_helper.is_in_url(domain, response.url):
         # Save cookies
         logger.debug("Parsing response.text()=%d Bytes ...", len(response.text))
         cookies.store(domain, response.cookies.get_dict())
@@ -64,6 +67,11 @@ def determine(domain: str, headers: dict) -> dict:
         if tag is not None:
             logger.debug("Adding CSRF token='%s' for domain='%s'", tag["content"], domain)
             reqheaders["X-CSRF-Token"] = tag["content"]
+    elif not domain_helper.is_in_url(domain, response.url):
+        logger.warning("domain='%s' doesn't match with response.url='%s', maybe redirect to other domain?", domain, response.url)
+        message = f"Redirect from domain='{domain}' to response.url='{response.url}'"
+        instances.set_last_error(domain, message)
+        raise requests.exceptions.TooManyRedirects(message)
 
     logger.debug("reqheaders()=%d - EXIT!", len(reqheaders))
     return reqheaders