mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-17 22:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads.

Browse source 
Thanks Alan Ryan for the report and initial patch.
This commit is contained in:
Mariusz Felisiak 2022-01-21 07:50:03 +01:00
parent 394517f078
commit fc18f36c4a
5 changed files with 40 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/file_uploads/tests.py
View file

@ -139,6 +139,26 @@ class FileUploadTests(TestCase):
def test_big_base64_newlines_upload(self):
self._test_base64_upload("Big data" * 68000, encode=base64.encodebytes)
def test_base64_invalid_upload(self):
payload = client.FakePayload('\r\n'.join([
'--' + client.BOUNDARY,
'Content-Disposition: form-data; name="file"; filename="test.txt"',
'Content-Type: application/octet-stream',
'Content-Transfer-Encoding: base64',
''
]))
payload.write(b'\r\n!\r\n')
payload.write('--' + client.BOUNDARY + '--\r\n')
r = {
'CONTENT_LENGTH': len(payload),
'CONTENT_TYPE': client.MULTIPART_CONTENT,
'PATH_INFO': '/echo_content/',
'REQUEST_METHOD': 'POST',
'wsgi.input': payload,
}
response = self.client.request(**r)
self.assertEqual(response.json()['file'], '')
def test_unicode_file_name(self):
with sys_tempfile.TemporaryDirectory() as temp_dir:
# This file contains Chinese symbols and an accented char in the name.