mirror of
https://github.com/django/django.git
synced 2025-11-07 07:15:35 +00:00
Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.
Thanks Seokchan Yoon for the report, Markus Holtermann for the
triage, and Jake Howard for the review.
Follow-up to CVE-2025-27556 and 39e2297210.
This commit is contained in:
@@ -24,6 +24,7 @@ from django.http import (
|
||||
)
|
||||
from django.test import SimpleTestCase
|
||||
from django.utils.functional import lazystr
|
||||
from django.utils.http import MAX_URL_LENGTH
|
||||
|
||||
|
||||
class QueryDictTests(SimpleTestCase):
|
||||
@@ -490,6 +491,7 @@ class HttpResponseTests(SimpleTestCase):
|
||||
'data:text/html,<script>window.alert("xss")</script>',
|
||||
"mailto:test@example.com",
|
||||
"file:///etc/passwd",
|
||||
"é" * (MAX_URL_LENGTH + 1),
|
||||
]
|
||||
for url in bad_urls:
|
||||
with self.assertRaises(DisallowedRedirect):
|
||||
|
||||
Reference in New Issue
Block a user