A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/django/django/commit/546740544d7f69254a67b06a3fc7fa0c43512958 below:

[1.7.x] Fixed a remote code execution vulnerabilty in URL reversing. · django/django@5467405 · GitHub

File tree Expand file treeCollapse file tree 5 files changed

+49

-1

lines changed

Filter options

Expand file treeCollapse file tree 5 files changed

+49

-1

lines changed Original file line number Diff line number Diff line change

@@ -245,6 +245,10 @@ def __init__(self, regex, urlconf_name, default_kwargs=None, app_name=None, name

245 245

self._reverse_dict = {}

246 246

self._namespace_dict = {}

247 247

self._app_dict = {}

248 +

# set of dotted paths to all functions and classes that are used in

249 +

# urlpatterns

250 +

self._callback_strs = set()

251 +

self._populated = False

248 252 249 253

def __repr__(self):

250 254

if isinstance(self.urlconf_name, list) and len(self.urlconf_name):

@@ -262,6 +266,15 @@ def _populate(self):

262 266

apps = {}

263 267

language_code = get_language()

264 268

for pattern in reversed(self.url_patterns):

269 +

if hasattr(pattern, '_callback_str'):

270 +

self._callback_strs.add(pattern._callback_str)

271 +

elif hasattr(pattern, '_callback'):

272 +

callback = pattern._callback

273 +

if not hasattr(callback, '__name__'):

274 +

lookup_str = callback.__module__ + "." + callback.__class__.__name__

275 +

else:

276 +

lookup_str = callback.__module__ + "." + callback.__name__

277 +

self._callback_strs.add(lookup_str)

265 278

p_pattern = pattern.regex.pattern

266 279

if p_pattern.startswith('^'):

267 280

p_pattern = p_pattern[1:]

@@ -280,6 +293,7 @@ def _populate(self):

280 293

namespaces[namespace] = (p_pattern + prefix, sub_pattern)

281 294

for app_name, namespace_list in pattern.app_dict.items():

282 295

apps.setdefault(app_name, []).extend(namespace_list)

296 +

self._callback_strs.update(pattern._callback_strs)

283 297

else:

284 298

bits = normalize(p_pattern)

285 299

lookups.appendlist(pattern.callback, (bits, p_pattern, pattern.default_args))

@@ -288,6 +302,7 @@ def _populate(self):

288 302

self._reverse_dict[language_code] = lookups

289 303

self._namespace_dict[language_code] = namespaces

290 304

self._app_dict[language_code] = apps

305 +

self._populated = True

291 306 292 307

@property

293 308

def reverse_dict(self):

@@ -387,8 +402,12 @@ def _reverse_with_prefix(self, lookup_view, _prefix, *args, **kwargs):

387 402

text_args = [force_text(v) for v in args]

388 403

text_kwargs = dict((k, force_text(v)) for (k, v) in kwargs.items())

389 404 405 +

if not self._populated:

406 +

self._populate()

407 + 390 408

try:

391 -

lookup_view = get_callable(lookup_view, True)

409 +

if lookup_view in self._callback_strs:

410 +

lookup_view = get_callable(lookup_view, True)

392 411

except (ImportError, AttributeError) as e:

393 412

raise NoReverseMatch("Error importing '%s': %s." % (lookup_view, e))

394 413

possibilities = self.reverse_dict.getlist(lookup_view)

Original file line number Diff line number Diff line change

@@ -0,0 +1,3 @@

1 +

def view(request):

2 +

"""Stub view"""

3 +

pass

Original file line number Diff line number Diff line change

@@ -1,8 +1,10 @@

1 +

# -*- coding: utf-8 -*-

1 2

"""

2 3

Unit tests for reverse URL lookups.

3 4

"""

4 5

from __future__ import unicode_literals

5 6 7 +

import sys

6 8

import unittest

7 9 8 10

from django.contrib.auth.models import User

@@ -355,6 +357,25 @@ def test_redirect_to_url(self):

355 357

self.assertEqual(res.url, '/foo/')

356 358

res = redirect('http://example.com/')

357 359

self.assertEqual(res.url, 'http://example.com/')

360 +

# Assert that we can redirect using UTF-8 strings

361 +

res = redirect('/æøå/abc/')

362 +

self.assertEqual(res.url, '/%C3%A6%C3%B8%C3%A5/abc/')

363 +

# Assert that no imports are attempted when dealing with a relative path

364 +

# (previously, the below would resolve in a UnicodeEncodeError from __import__ )

365 +

res = redirect('/æøå.abc/')

366 +

self.assertEqual(res.url, '/%C3%A6%C3%B8%C3%A5.abc/')

367 +

res = redirect('os.path')

368 +

self.assertEqual(res.url, 'os.path')

369 + 370 +

def test_no_illegal_imports(self):

371 +

# modules that are not listed in urlpatterns should not be importable

372 +

redirect("urlpatterns_reverse.nonimported_module.view")

373 +

self.assertNotIn("urlpatterns_reverse.nonimported_module", sys.modules)

374 + 375 +

def test_reverse_by_path_nested(self):

376 +

# Views that are added to urlpatterns using include() should be

377 +

# reversable by doted path.

378 +

self.assertEqual(reverse('urlpatterns_reverse.views.nested_view'), '/includes/nested_path/')

358 379 359 380

def test_redirect_view_object(self):

360 381

from .views import absolute_kwargs_view

Original file line number Diff line number Diff line change

@@ -5,6 +5,7 @@

5 5 6 6

other_patterns = patterns('',

7 7

url(r'non_path_include/$', empty_view, name='non_path_include'),

8 +

url(r'nested_path/$', 'urlpatterns_reverse.views.nested_view'),

8 9

)

9 10 10 11

urlpatterns = patterns('',

Original file line number Diff line number Diff line change

@@ -21,6 +21,10 @@ def defaults_view(request, arg1, arg2):

21 21

pass

22 22 23 23 24 +

def nested_view(request):

25 +

pass

26 + 27 + 24 28

def erroneous_view(request):

25 29

import non_existent # NOQA

26 30

You can’t perform that action at this time.


RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4