#35901: settings.DEBUG could reject non-empty string values (or in particular
"off", "no", "0", "disabled", "false", "False")
-------------------------------------+-------------------------------------
Reporter: Sebastian Pipping | Type:
| Uncategorized
Status: new | Component: Core
| (Other)
Version: dev | Severity: Normal
Keywords: security debug | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Hi!
I came across a setup recently where (simplified) troubling code `DEBUG =
os.environ.get("DEBUG", False)` with environment variables state `DEBUG=0`
(and later `DEBUG=False`) was activating Debug mode (while not intended to
and and unaware of) in practice because these (and all other non-empty)
strings evaluate to `True` in Python:
{{{
In [1]: bool("")
Out[1]: False
In [2]: bool("False")
Out[2]: True
In [3]: bool("0")
Out[3]: True
}}}
The related code is Open Source and my related pull request for their
project is public at
https://github.com/climateconnect/climateconnect/pull/1331 .
To cheaply protect users from accidents like these (that can easily result
in arbitrary remote code execution) in the future, Django could reject
values from `settings.DEBUG` that are (a) any string or (b) any non-empty
string or (c) in a list of known excluded words (e.g. "off", "no", "0",
"disabled", "false", "False").
What do you think?
--
Ticket URL: <https://code.djangoproject.com/ticket/35901>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019311c0b8bc-bccc8f1c-5bc3-460e-bd07-9daad06a9561-000000%40eu-central-1.amazonses.com.
