1
0
mirror of https://github.com/django/django.git synced 2025-07-07 11:19:12 +00:00
Natalia ac03c5e7df [4.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in log_response().
Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.

To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.

Co-authored-by: Carlton Gibson <carlton@noumenal.es>
Co-authored-by: Jake Howard <git@theorangeone.net>

Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.
2025-06-04 08:50:05 -03:00
..
2022-03-08 14:50:06 +01:00
2017-06-01 13:23:48 -04:00

To run the test suite, first, create and activate a virtual environment. Then
install some requirements and run the tests::

    $ cd tests
    $ python -m pip install -e ..
    $ python -m pip install -r requirements/py3.txt
    $ ./runtests.py

For more information about the test suite, see
https://docs.djangoproject.com/en/dev/internals/contributing/writing-code/unit-tests/.