Re: Should Django use Ada?

2024-04-02 Thread 'Michael Lissner' via Django developers (Contributions to Django itself)
Thanks for the replies everybody. A few thoughts >From Adrián: > You should probably be addressing urllib devs with this inquiry (e.g. such vuln is then probably in many other web frameworks) I did that in 2021 when I found the issue with newlines in URLs. Python devs had the resources to

Should Django use Ada?

2024-04-01 Thread 'Michael Lissner' via Django developers (Contributions to Django itself)
Hi all, A few years ago, I reported a vulnerability in Django because Python wasn't parsing URLs containing tabs or newlines correctly. In this ticket, it was fixed in Python: https://bugs.python.org/issue43882 But Python, being maintained mostly by volunteers, did the minimum needed work

Re: Intermittent IntegrityError on Model Save with auto_now and auto_now_add Fields

2024-03-25 Thread 'Michael Lissner' via Django developers (Contributions to Django itself)
Looks like this issue isn't affecting lots of folks, since nobody is piping up, so I'll just add that if anybody arrives here in the future, we'll be tracking this in a public issue here: https://github.com/freelawproject/courtlistener/issues/3359 My theory is it has something to do with race

Update security docs re HOST header and ALLOWED_HOSTS?

2022-05-12 Thread 'Michael Lissner' via Django developers (Contributions to Django itself)
There's a vague warning in the security docs that says: > many common web servers [have] a configuration that seems to validate the > Host header [that] may not in fact do so. For instance, even if Apache is >