diff options
author | Aymeric Augustin <aymeric.augustin@m4x.org> | 2014-04-20 16:10:32 -0400 |
---|---|---|
committer | Tim Graham <timograham@gmail.com> | 2014-04-21 18:11:26 -0400 |
commit | c083e3815aec23b99833da710eea574e6f2e8566 (patch) | |
tree | 8f5b11d9618ba548ff633037ecca763094838d23 /tests/cache | |
parent | 8b93b31487d6d3b0fcbbd0498991ea0db9088054 (diff) | |
download | django-c083e3815aec23b99833da710eea574e6f2e8566.tar.gz |
Prevented leaking the CSRF token through caching.
This is a security fix. Disclosure will follow shortly.
Diffstat (limited to 'tests/cache')
-rw-r--r-- | tests/cache/tests.py | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/tests/cache/tests.py b/tests/cache/tests.py index aa6beac0f2..0439d25c20 100644 --- a/tests/cache/tests.py +++ b/tests/cache/tests.py @@ -18,11 +18,13 @@ from django.conf import settings from django.core import management from django.core.cache import (cache, caches, CacheKeyWarning, InvalidCacheBackendError, DEFAULT_CACHE_ALIAS) +from django.core.context_processors import csrf from django.db import connection, connections, router, transaction from django.core.cache.utils import make_template_fragment_key from django.http import HttpResponse, StreamingHttpResponse from django.middleware.cache import (FetchFromCacheMiddleware, UpdateCacheMiddleware, CacheMiddleware) +from django.middleware.csrf import CsrfViewMiddleware from django.template import Template from django.template.response import TemplateResponse from django.test import TestCase, TransactionTestCase, RequestFactory, override_settings @@ -1741,6 +1743,10 @@ def hello_world_view(request, value): return HttpResponse('Hello World %s' % value) +def csrf_view(request): + return HttpResponse(csrf(request)['csrf_token']) + + @override_settings( CACHE_MIDDLEWARE_ALIAS='other', CACHE_MIDDLEWARE_KEY_PREFIX='middlewareprefix', @@ -1905,6 +1911,27 @@ class CacheMiddlewareTest(TestCase): response = other_with_prefix_view(request, '16') self.assertEqual(response.content, b'Hello World 16') + def test_sensitive_cookie_not_cached(self): + """ + Django must prevent caching of responses that set a user-specific (and + maybe security sensitive) cookie in response to a cookie-less request. + """ + csrf_middleware = CsrfViewMiddleware() + cache_middleware = CacheMiddleware() + + request = self.factory.get('/view/') + self.assertIsNone(cache_middleware.process_request(request)) + + csrf_middleware.process_view(request, csrf_view, (), {}) + + response = csrf_view(request) + + response = csrf_middleware.process_response(request, response) + response = cache_middleware.process_response(request, response) + + # Inserting a CSRF cookie in a cookie-less request prevented caching. + self.assertIsNone(cache_middleware.process_request(request)) + @override_settings( CACHE_MIDDLEWARE_KEY_PREFIX='settingsprefix', |