mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #28693 -- Fixed crash in CsrfViewMiddleware when an HTTPS request has an invalid host.

Browse source
This commit is contained in:
Tomer Chachamu 2017-10-22 00:56:01 +01:00 • committed by Tim Graham
parent ff5517988a
commit 7ec0fdf62a
2 changed files with 23 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/csrf_tests/tests.py
View file

@ -294,6 +294,19 @@ class CsrfViewMiddlewareTestMixin:
status_code=403,
)
def test_https_malformed_host(self):
"""
CsrfViewMiddleware generates a 403 response if it receives an HTTPS
request with a bad host.
"""
req = self._get_GET_no_csrf_cookie_request()
req._is_secure_override = True
req.META['HTTP_HOST'] = '@malformed'
req.META['HTTP_REFERER'] = 'https://www.evil.org/somepage'
req.META['SERVER_PORT'] = '443'
response = self.mw.process_view(req, token_view, (), {})
self.assertEqual(response.status_code, 403)
@override_settings(DEBUG=True)
def test_https_malformed_referer(self):
"""