mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-09 18:12:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.

Browse source 
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603
This commit is contained in:
Mariusz Felisiak 2021-05-06 08:45:23 +02:00 • committed by GitHub
parent a708f39ce6
commit e1e81aa1c4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 73 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/validators/tests.py
View file

@ -226,9 +226,15 @@ TEST_DATA = [
(URLValidator(), None, ValidationError),
(URLValidator(), 56, ValidationError),
(URLValidator(), 'no_scheme', ValidationError),
# Trailing newlines not accepted
# Newlines and tabs are not accepted.
(URLValidator(), 'http://www.djangoproject.com/\n', ValidationError),
(URLValidator(), 'http://[::ffff:192.9.5.5]\n', ValidationError),
(URLValidator(), 'http://www.djangoproject.com/\r', ValidationError),
(URLValidator(), 'http://[::ffff:192.9.5.5]\r', ValidationError),
(URLValidator(), 'http://www.django\rproject.com/', ValidationError),
(URLValidator(), 'http://[::\rffff:192.9.5.5]', ValidationError),
(URLValidator(), 'http://\twww.djangoproject.com/', ValidationError),
(URLValidator(), 'http://\t[::ffff:192.9.5.5]', ValidationError),
# Trailing junk does not take forever to reject
(URLValidator(), 'http://www.asdasdasdasdsadfm.com.br ', ValidationError),
(URLValidator(), 'http://www.asdasdasdasdsadfm.com.br z', ValidationError),