diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2021-05-06 08:45:23 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-06 08:45:23 +0200 |
| commit | e1e81aa1c4427411e3c68facdd761229ffea6f6f (patch) | |
| tree | 6afff14e0eba2452db3add415e60fe0219aec75e /tests/validators | |
| parent | a708f39ce67af174df90c5b5e50ad1976cec7cb8 (diff) | |
| download | django-e1e81aa1c4427411e3c68facdd761229ffea6f6f.tar.gz | |
Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.
[1] https://bugs.python.org/issue43882 and
[2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4
Diffstat (limited to 'tests/validators')
| -rw-r--r-- | tests/validators/tests.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/tests/validators/tests.py b/tests/validators/tests.py index d6d013c026..09d5c40ff5 100644 --- a/tests/validators/tests.py +++ b/tests/validators/tests.py @@ -226,9 +226,15 @@ TEST_DATA = [ (URLValidator(), None, ValidationError), (URLValidator(), 56, ValidationError), (URLValidator(), 'no_scheme', ValidationError), - # Trailing newlines not accepted + # Newlines and tabs are not accepted. (URLValidator(), 'http://www.djangoproject.com/\n', ValidationError), (URLValidator(), 'http://[::ffff:192.9.5.5]\n', ValidationError), + (URLValidator(), 'http://www.djangoproject.com/\r', ValidationError), + (URLValidator(), 'http://[::ffff:192.9.5.5]\r', ValidationError), + (URLValidator(), 'http://www.django\rproject.com/', ValidationError), + (URLValidator(), 'http://[::\rffff:192.9.5.5]', ValidationError), + (URLValidator(), 'http://\twww.djangoproject.com/', ValidationError), + (URLValidator(), 'http://\t[::ffff:192.9.5.5]', ValidationError), # Trailing junk does not take forever to reject (URLValidator(), 'http://www.asdasdasdasdsadfm.com.br ', ValidationError), (URLValidator(), 'http://www.asdasdasdasdsadfm.com.br z', ValidationError), |