mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-25 22:56:12 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.

Browse Source 
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
This commit is contained in:
Mariusz Felisiak
2023-10-17 11:48:32 +02:00
parent 3fae5d92da
commit 048a9ebb6e
5 changed files with 50 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tests/auth_tests/test_forms.py
View File

@@ -14,6 +14,7 @@ from django.contrib.auth.forms import (
SetPasswordForm,
UserChangeForm,
UserCreationForm,
UsernameField,
)
from django.contrib.auth.models import User
from django.contrib.auth.signals import user_login_failed
@@ -154,6 +155,12 @@ class BaseUserCreationFormTest(TestDataMixin, TestCase):
self.assertNotEqual(user.username, ohm_username)
self.assertEqual(user.username, "testΩ") # U+03A9 GREEK CAPITAL LETTER OMEGA
def test_invalid_username_no_normalize(self):
field = UsernameField(max_length=254)
# Usernames are not normalized if they are too long.
self.assertEqual(field.to_python("½" * 255), "½" * 255)
self.assertEqual(field.to_python("ff" * 254), "ff" * 254)
def test_duplicate_normalized_unicode(self):
"""
To prevent almost identical usernames, visually identical but differing