mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-04 17:59:13 +00:00
Code Issues 32 Releases Wiki Activity

Added missed poisoned host header test material

Browse Source
This commit is contained in:
Preston Holmes 2012-10-18 11:21:54 -07:00
parent 25d23d9846
commit 6383d2358c
1 changed files with 67 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
tests/regressiontests/requests/tests.py
View File

@ -4,6 +4,7 @@ from StringIO import StringIO
from django.conf import settings from django.conf import settings
from django.core.handlers.modpython import ModPythonRequest from django.core.handlers.modpython import ModPythonRequest
from django.core.exceptions import SuspiciousOperation
from django.core.handlers.wsgi import WSGIRequest, LimitedStream from django.core.handlers.wsgi import WSGIRequest, LimitedStream
from django.http import HttpRequest, HttpResponse, parse_cookie from django.http import HttpRequest, HttpResponse, parse_cookie
from django.utils import unittest from django.utils import unittest
@ -101,6 +102,39 @@ class RequestsTests(unittest.TestCase):
} }
self.assertEqual(request.get_host(), 'internal.com:8042') self.assertEqual(request.get_host(), 'internal.com:8042')
# Poisoned host headers are rejected as suspicious
legit_hosts = [
'example.com',
'example.com:80',
'12.34.56.78',
'12.34.56.78:443',
'[2001:19f0:feee::dead:beef:cafe]',
'[2001:19f0:feee::dead:beef:cafe]:8080',
]
poisoned_hosts = [
'example.com@evil.tld',
'example.com:dr.frankenstein@evil.tld',
'example.com:someone@somestie.com:80',
'example.com:80/badpath'
]
for host in legit_hosts:
request = HttpRequest()
request.META = {
'HTTP_HOST': host,
}
request.get_host()
for host in poisoned_hosts:
def test_host_poisoning():
request = HttpRequest()
request.META = {
'HTTP_HOST': host,
}
request.get_host()
self.assertRaises(SuspiciousOperation, test_host_poisoning)
finally: finally:
settings.USE_X_FORWARDED_HOST = old_USE_X_FORWARDED_HOST settings.USE_X_FORWARDED_HOST = old_USE_X_FORWARDED_HOST
@ -145,6 +179,39 @@ class RequestsTests(unittest.TestCase):
} }
self.assertEqual(request.get_host(), 'internal.com:8042') self.assertEqual(request.get_host(), 'internal.com:8042')
# Poisoned host headers are rejected as suspicious
legit_hosts = [
'example.com',
'example.com:80',
'12.34.56.78',
'12.34.56.78:443',
'[2001:19f0:feee::dead:beef:cafe]',
'[2001:19f0:feee::dead:beef:cafe]:8080',
]
poisoned_hosts = [
'example.com@evil.tld',
'example.com:dr.frankenstein@evil.tld',
'example.com:dr.frankenstein@evil.tld:80',
'example.com:80/badpath'
]
for host in legit_hosts:
request = HttpRequest()
request.META = {
'HTTP_HOST': host,
}
request.get_host()
for host in poisoned_hosts:
def test_host_poisoning():
request = HttpRequest()
request.META = {
'HTTP_HOST': host,
}
request.get_host()
self.assertRaises(SuspiciousOperation, test_host_poisoning)
finally: finally:
settings.USE_X_FORWARDED_HOST = old_USE_X_FORWARDED_HOST settings.USE_X_FORWARDED_HOST = old_USE_X_FORWARDED_HOST