#29606: Validate the type of ALLOWED_HOSTS to prevent possible issues and wasted
time
-------------------------------------+-------------------------------------
Reporter: rafis | Owner: nobody
Type: New | Status: new
feature |
Component: Core | Version: 2.0
(System checks) |
Severity: Normal | Keywords: allowed_hosts
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
-------------------------------------+-------------------------------------
Python has soft behavior for conducting iteration process over lists and
over strings making them look the same:
{{{#!python
for char_or_item in str_or_list:
-- `char_or_item` can be character or list item
}}}
It would be better if it would have more strict behavior, for example,
{{{#!python
for char in some_str.chars():
-- now `char` can be only of string type and `list` class would
not have `chars` method
}}}
and for list
{{{#!python
for item in some_list.list_items():
-- `string` class would not have `list_items` method
}}}
This soft behavior usually leads to many nasty bugs to appear. Our two
software engineers from our team wasted about 1 hour debugging the issue
with ALLOWED_HOSTS being initialized with string in `local_settings.py`
which is included at the end of `settings.py`. Django was matching each
separate character of ALLOWED_HOSTS string against the "Host:" header from
an incoming HTTP request.
An obvious self-suggesting solution is to add a new system check that will
check the type of ALLOWED_HOSTS if it is string or not and notify the
developer about possible improper configuration. I think blacklist
checking (string or not) is more appropiate here, but I can be wrong.
--
Ticket URL: <https://code.djangoproject.com/ticket/29606>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/048.7e8766aaf89f22f32f5fb264f8e7d7a9%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
