Author: ubernostrum
Date: 2010-09-08 19:34:54 -0500 (Wed, 08 Sep 2010)
New Revision: 13698
Modified:
django/trunk/django/middleware/csrf.py
django/trunk/django/template/defaulttags.py
django/trunk/tests/regressiontests/csrf_tests/tests.py
Log:
Patch CSRF-protection system to deal with reported security issue. Announcement
and details to follow.
Modified: django/trunk/django/middleware/csrf.py
===================================================================
--- django/trunk/django/middleware/csrf.py 2010-09-07 20:59:28 UTC (rev
13697)
+++ django/trunk/django/middleware/csrf.py 2010-09-09 00:34:54 UTC (rev
13698)
@@ -13,6 +13,7 @@
from django.core.urlresolvers import get_callable
from django.utils.cache import patch_vary_headers
from django.utils.hashcompat import md5_constructor
+from django.utils.html import escape
from django.utils.safestring import mark_safe
_POST_FORM_RE = \
@@ -52,7 +53,8 @@
def get_token(request):
"""
- Returns the the CSRF token required for a POST form.
+ Returns the the CSRF token required for a POST form. No assumptions should
+ be made about what characters might be in the CSRF token.
A side effect of calling this function is to make the the csrf_protect
decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
@@ -247,7 +249,7 @@
"""Returns the matched <form> tag plus the added <input>
element"""
return mark_safe(match.group() + "<div style='display:none;'>"
+ \
"<input type='hidden' " + idattributes.next() + \
- " name='csrfmiddlewaretoken' value='" + csrf_token + \
+ " name='csrfmiddlewaretoken' value='" + escape(csrf_token) + \
"' /></div>")
# Modify any POST forms
Modified: django/trunk/django/template/defaulttags.py
===================================================================
--- django/trunk/django/template/defaulttags.py 2010-09-07 20:59:28 UTC (rev
13697)
+++ django/trunk/django/template/defaulttags.py 2010-09-09 00:34:54 UTC (rev
13698)
@@ -9,6 +9,7 @@
from django.template import get_library, Library, InvalidTemplateLibrary
from django.template.smartif import IfParser, Literal
from django.conf import settings
+from django.utils.html import escape
from django.utils.encoding import smart_str, smart_unicode
from django.utils.safestring import mark_safe
@@ -42,7 +43,7 @@
if csrf_token == 'NOTPROVIDED':
return mark_safe(u"")
else:
- return mark_safe(u"<div style='display:none'><input
type='hidden' name='csrfmiddlewaretoken' value='%s' /></div>" % (csrf_token))
+ return mark_safe(u"<div style='display:none'><input
type='hidden' name='csrfmiddlewaretoken' value='%s' /></div>" %
escape(csrf_token))
else:
# It's very probable that the token is missing because of
# misconfiguration, so we raise a warning
Modified: django/trunk/tests/regressiontests/csrf_tests/tests.py
===================================================================
--- django/trunk/tests/regressiontests/csrf_tests/tests.py 2010-09-07
20:59:28 UTC (rev 13697)
+++ django/trunk/tests/regressiontests/csrf_tests/tests.py 2010-09-09
00:34:54 UTC (rev 13698)
@@ -6,6 +6,7 @@
from django.views.decorators.csrf import csrf_exempt, csrf_view_exempt
from django.core.context_processors import csrf
from django.contrib.sessions.middleware import SessionMiddleware
+from django.utils.html import escape
from django.utils.importlib import import_module
from django.conf import settings
from django.template import RequestContext, Template
@@ -56,7 +57,9 @@
return getattr(self, '_is_secure', False)
class CsrfMiddlewareTest(TestCase):
- _csrf_id = "1"
+ # The csrf token is potentially from an untrusted source, so could have
+ # characters that need escaping
+ _csrf_id = "<1>"
# This is a valid session token for this ID and secret key. This was
generated using
# the old code that we're to be backwards-compatible with. Don't use the
CSRF code
@@ -101,7 +104,7 @@
return req
def _check_token_present(self, response, csrf_id=None):
- self.assertContains(response, "name='csrfmiddlewaretoken' value='%s'"
% (csrf_id or self._csrf_id))
+ self.assertContains(response, "name='csrfmiddlewaretoken' value='%s'"
% escape(csrf_id or self._csrf_id))
# Check the post processing and outgoing cookie
def test_process_response_no_csrf_cookie(self):
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/django-updates?hl=en.
