mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-28 08:06:09 +00:00
Code Issues 32 Releases Wiki Activity

[1.5.x] Added a new required ALLOWED_HOSTS setting for HTTP host header validation.

Browse Source 
This is a security fix; disclosure and advisory coming shortly.
This commit is contained in:
Carl Meyer
2013-02-09 10:26:24 -07:00
parent 5d853db90e
commit a7e33c5bf3
12 changed files with 169 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
tests/regressiontests/requests/tests.py
View File

@@ -84,7 +84,13 @@ class RequestsTests(unittest.TestCase):
self.assertEqual(request.build_absolute_uri(location="/path/with:colons"),
'http://www.example.com/path/with:colons')
@override_settings(USE_X_FORWARDED_HOST=False)
@override_settings(
USE_X_FORWARDED_HOST=False,
ALLOWED_HOSTS=[
'forward.com', 'example.com', 'internal.com', '12.34.56.78',
'[2001:19f0:feee::dead:beef:cafe]', 'xn--4ca9at.com',
'.multitenant.com', 'INSENSITIVE.com',
])
def test_http_get_host(self):
# Check if X_FORWARDED_HOST is provided.
request = HttpRequest()
@@ -131,6 +137,9 @@ class RequestsTests(unittest.TestCase):
'[2001:19f0:feee::dead:beef:cafe]',
'[2001:19f0:feee::dead:beef:cafe]:8080',
'xn--4ca9at.com', # Punnycode for öäü.com
'anything.multitenant.com',
'multitenant.com',
'insensitive.com',
]
poisoned_hosts = [
@@ -139,6 +148,7 @@ class RequestsTests(unittest.TestCase):
'example.com:dr.frankenstein@evil.tld:80',
'example.com:80/badpath',
'example.com: recovermypassword.com',
'other.com', # not in ALLOWED_HOSTS
]
for host in legit_hosts:
@@ -156,7 +166,7 @@ class RequestsTests(unittest.TestCase):
}
request.get_host()
@override_settings(USE_X_FORWARDED_HOST=True)
@override_settings(USE_X_FORWARDED_HOST=True, ALLOWED_HOSTS=['*'])
def test_http_get_host_with_x_forwarded_host(self):
# Check if X_FORWARDED_HOST is provided.
request = HttpRequest()
@@ -229,6 +239,16 @@ class RequestsTests(unittest.TestCase):
request.get_host()
@override_settings(DEBUG=True, ALLOWED_HOSTS=[])
def test_host_validation_disabled_in_debug_mode(self):
"""If ALLOWED_HOSTS is empty and DEBUG is True, all hosts pass."""
request = HttpRequest()
request.META = {
'HTTP_HOST': 'example.com',
}
self.assertEqual(request.get_host(), 'example.com')
def test_near_expiration(self):
"Cookie will expire when an near expiration time is provided"
response = HttpResponse()