mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-31 07:47:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed #32571 -- Made CsrfViewMiddleware handle invalid URLs in Referer header.

Browse source
This commit is contained in:
Adam Donaghy 2021-03-19 20:42:05 +11:00 • committed by Mariusz Felisiak
parent 474cc420bf
commit e49fdfa405
2 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/csrf_tests/tests.py
View file

@ -353,6 +353,12 @@ class CsrfViewMiddlewareTestMixin:
req.META['HTTP_REFERER'] = 'https://'
response = mw.process_view(req, post_form_view, (), {})
self.assertContains(response, malformed_referer_msg, status_code=403)
# Invalid URL
# >>> urlparse('https://[')
# ValueError: Invalid IPv6 URL
req.META['HTTP_REFERER'] = 'https://['
response = mw.process_view(req, post_form_view, (), {})
self.assertContains(response, malformed_referer_msg, status_code=403)
@override_settings(ALLOWED_HOSTS=['www.example.com'])
def test_https_good_referer(self):