mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-26 15:16:09 +00:00
Code Issues 32 Releases Wiki Activity

[3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.

Browse Source 
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4 from main.
This commit is contained in:
Mariusz Felisiak
2021-05-04 20:50:12 +02:00
parent a937d7f214
commit 2d2c1d0c97
6 changed files with 73 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/validators/tests.py
View File

@@ -226,9 +226,15 @@ TEST_DATA = [
(URLValidator(), None, ValidationError),
(URLValidator(), 56, ValidationError),
(URLValidator(), 'no_scheme', ValidationError),
# Trailing newlines not accepted
# Newlines and tabs are not accepted.
(URLValidator(), 'http://www.djangoproject.com/\n', ValidationError),
(URLValidator(), 'http://[::ffff:192.9.5.5]\n', ValidationError),
(URLValidator(), 'http://www.djangoproject.com/\r', ValidationError),
(URLValidator(), 'http://[::ffff:192.9.5.5]\r', ValidationError),
(URLValidator(), 'http://www.django\rproject.com/', ValidationError),
(URLValidator(), 'http://[::\rffff:192.9.5.5]', ValidationError),
(URLValidator(), 'http://\twww.djangoproject.com/', ValidationError),
(URLValidator(), 'http://\t[::ffff:192.9.5.5]', ValidationError),
# Trailing junk does not take forever to reject
(URLValidator(), 'http://www.asdasdasdasdsadfm.com.br ', ValidationError),
(URLValidator(), 'http://www.asdasdasdasdsadfm.com.br z', ValidationError),