mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2018-14574 -- Fixed open redirect possibility in CommonMiddleware.

Browse Source
This commit is contained in:
Andreas Hug
2018-07-24 16:18:17 -04:00
committed by Tim Graham
parent 7dbe7aa0b6
commit a656a68127
8 changed files with 78 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
tests/utils_tests/test_http.py
View File

@@ -5,10 +5,10 @@ from django.test import SimpleTestCase, ignore_warnings
from django.utils.datastructures import MultiValueDict
from django.utils.deprecation import RemovedInDjango30Warning
from django.utils.http import (
base36_to_int, cookie_date, http_date, int_to_base36, is_safe_url,
is_same_domain, parse_etags, parse_http_date, quote_etag, urlencode,
urlquote, urlquote_plus, urlsafe_base64_decode, urlsafe_base64_encode,
urlunquote, urlunquote_plus,
base36_to_int, cookie_date, escape_leading_slashes, http_date,
int_to_base36, is_safe_url, is_same_domain, parse_etags, parse_http_date,
quote_etag, urlencode, urlquote, urlquote_plus, urlsafe_base64_decode,
urlsafe_base64_encode, urlunquote, urlunquote_plus,
)
@@ -275,3 +275,14 @@ class HttpDateProcessingTests(unittest.TestCase):
def test_parsing_asctime(self):
parsed = parse_http_date('Sun Nov 6 08:49:37 1994')
self.assertEqual(datetime.utcfromtimestamp(parsed), datetime(1994, 11, 6, 8, 49, 37))
class EscapeLeadingSlashesTests(unittest.TestCase):
def test(self):
tests = (
('//example.com', '/%2Fexample.com'),
('//', '/%2F'),
)
for url, expected in tests:
with self.subTest(url=url):
self.assertEqual(escape_leading_slashes(url), expected)