mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-09-22 10:12:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed #26308 -- Prevented crash with binary URLs in is_safe_url()

Browse source 
This fixes a regression introduced by c5544d2892.
Thanks John Eskew for the reporti and Tim Graham for the review.
This commit is contained in:
Claude Paroz 2016-03-04 15:41:52 +01:00
parent cecbf1bdef
commit ada7a4aefb
4 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/utils_tests/test_http.py
View file

@ -1,3 +1,4 @@
# -*- encoding: utf-8 -*-
from __future__ import unicode_literals
import sys
@ -114,6 +115,17 @@ class TestUtilsHttp(unittest.TestCase):
'http://testserver/confirm?email=me@example.com',
'/url%20with%20spaces/'):
self.assertTrue(http.is_safe_url(good_url, host='testserver'), "%s should be allowed" % good_url)
if six.PY2:
# Check binary URLs, regression tests for #26308
self.assertTrue(
http.is_safe_url(b'https://testserver/', host='testserver'),
"binary URLs should be allowed on Python 2"
)
self.assertFalse(http.is_safe_url(b'\x08//example.com', host='testserver'))
self.assertTrue(http.is_safe_url('àview/'.encode('utf-8'), host='testserver'))
self.assertTrue(http.is_safe_url('àview'.encode('latin-1'), host='testserver'))
# Valid basic auth credentials are allowed.
self.assertTrue(http.is_safe_url(r'http://user:pass@testserver/', host='user:pass@testserver'))
# A path without host is allowed.