mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #36470 -- Prevented log injection in runserver when handling NOT FOUND.

Browse Source 
Migrated `WSGIRequestHandler.log_message()` to use a more robust
`log_message()` helper, which was based of `log_response()` via factoring out
the common bits.

Refs CVE-2025-48432.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
This commit is contained in:
YashRaj1506
2025-06-26 03:31:00 +05:30
committed by nessita
parent 5625bd5907
commit 9bb83925d6
3 changed files with 80 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
tests/servers/test_basehttp.py
View File

@@ -50,6 +50,21 @@ class WSGIRequestHandlerTestCase(SimpleTestCase):
cm.records[0].levelname, wrong_level.upper()
)
def test_log_message_escapes_control_sequences(self):
request = WSGIRequest(self.request_factory.get("/").environ)
request.makefile = lambda *args, **kwargs: BytesIO()
handler = WSGIRequestHandler(request, "192.168.0.2", None)
malicious_path = "\x1b[31mALERT\x1b[0m"
with self.assertLogs("django.server", "WARNING") as cm:
handler.log_message("GET %s %s", malicious_path, "404")
log = cm.output[0]
self.assertNotIn("\x1b[31m", log)
self.assertIn("\\x1b[31mALERT\\x1b[0m", log)
def test_https(self):
request = WSGIRequest(self.request_factory.get("/").environ)
request.makefile = lambda *args, **kwargs: BytesIO()