mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 17:16:24 +00:00
Code Issues 25 Releases Wiki Activity

Added safety to URL decoding in is_safe_url() on Python 2

Browse Source 
The errors='replace' parameter to force_text altered the URL before checking
it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef.
This commit is contained in:
Claude Paroz 2016-03-04 23:33:35 +01:00
parent ada7a4aefb
commit 552f03869e
4 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
django/utils/http.py
View File

@ -291,7 +291,10 @@ def is_safe_url(url, host=None):
if not url: if not url:
return False return False
if six.PY2: if six.PY2:
url = force_text(url, errors='replace') try:
url = force_text(url)
except UnicodeDecodeError:
return False
# Chrome treats \ completely as / in paths but it could be part of some # Chrome treats \ completely as / in paths but it could be part of some
# basic auth credentials so we need to check both URLs. # basic auth credentials so we need to check both URLs.
return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host) return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host)

2
docs/releases/1.8.11.txt
View File

@ -2,7 +2,7 @@
Django 1.8.11 release notes Django 1.8.11 release notes
=========================== ===========================
*March 4, 2016* *March 5, 2016*
Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`). where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).

2
docs/releases/1.9.4.txt
View File

@ -2,7 +2,7 @@
Django 1.9.4 release notes Django 1.9.4 release notes
========================== ==========================
*March 4, 2016* *March 5, 2016*
Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`). where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).

2
tests/utils_tests/test_http.py
View File

@ -124,7 +124,7 @@ class TestUtilsHttp(unittest.TestCase):
) )
self.assertFalse(http.is_safe_url(b'\x08//example.com', host='testserver')) self.assertFalse(http.is_safe_url(b'\x08//example.com', host='testserver'))
self.assertTrue(http.is_safe_url('àview/'.encode('utf-8'), host='testserver')) self.assertTrue(http.is_safe_url('àview/'.encode('utf-8'), host='testserver'))
self.assertTrue(http.is_safe_url('àview'.encode('latin-1'), host='testserver')) self.assertFalse(http.is_safe_url('àview'.encode('latin-1'), host='testserver'))
# Valid basic auth credentials are allowed. # Valid basic auth credentials are allowed.
self.assertTrue(http.is_safe_url(r'http://user:pass@testserver/', host='user:pass@testserver')) self.assertTrue(http.is_safe_url(r'http://user:pass@testserver/', host='user:pass@testserver'))