1
0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00

Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.

Thanks Seokchan Yoon for the report, Markus Holtermann for the
triage, and Jake Howard for the review.

Follow-up to CVE-2025-27556 and 39e2297210.
This commit is contained in:
Jacob Walls
2025-10-16 16:28:33 -04:00
committed by Natalia
parent 74564946c3
commit c880530ddd
5 changed files with 37 additions and 4 deletions

View File

@@ -24,6 +24,7 @@ from django.http import (
)
from django.test import SimpleTestCase
from django.utils.functional import lazystr
from django.utils.http import MAX_URL_LENGTH
class QueryDictTests(SimpleTestCase):
@@ -490,6 +491,7 @@ class HttpResponseTests(SimpleTestCase):
'data:text/html,<script>window.alert("xss")</script>',
"mailto:test@example.com",
"file:///etc/passwd",
"é" * (MAX_URL_LENGTH + 1),
]
for url in bad_urls:
with self.assertRaises(DisallowedRedirect):