+78
-8
lines changedFilter options
+78
-8
lines changed Original file line number Diff line number Diff line change
@@ -11,6 +11,7 @@
11 11
cc_delim_re, get_conditional_response, set_response_etag,
12 12
)
13 13
from django.utils.deprecation import MiddlewareMixin, RemovedInDjango21Warning
14 +
from django.utils.http import escape_leading_slashes
14 15 15 16 16 17
class CommonMiddleware(MiddlewareMixin):
@@ -88,6 +89,8 @@ def get_full_path_with_slash(self, request):
88 89
POST, PUT, or PATCH.
89 90
"""
90 91
new_path = request.get_full_path(force_append_slash=True)
92 +
# Prevent construction of scheme relative urls.
93 +
new_path = escape_leading_slashes(new_path)
91 94
if settings.DEBUG and request.method in ('POST', 'PUT', 'PATCH'):
92 95
raise RuntimeError(
93 96
"You called this URL via %(method)s, but the URL doesn't end "
@@ -17,7 +17,7 @@
17 17
from django.core.exceptions import ImproperlyConfigured
18 18
from django.utils.datastructures import MultiValueDict
19 19
from django.utils.functional import cached_property
20 -
from django.utils.http import RFC3986_SUBDELIMS
20 +
from django.utils.http import RFC3986_SUBDELIMS, escape_leading_slashes
21 21
from django.utils.regex_helper import normalize
22 22
from django.utils.translation import get_language
23 23
@@ -604,9 +604,7 @@ def _reverse_with_prefix(self, lookup_view, _prefix, *args, **kwargs):
604 604
# safe characters from `pchar` definition of RFC 3986
605 605
url = quote(candidate_pat % text_candidate_subs, safe=RFC3986_SUBDELIMS + '/~:@')
606 606
# Don't allow construction of scheme relative urls.
607 -
if url.startswith('//'):
608 -
url = '/%%2F%s' % url[2:]
609 -
return url
607 +
return escape_leading_slashes(url)
610 608
# lookup_view can be URL name or callable, but callables are not
611 609
# friendly in error messages.
612 610
m = getattr(lookup_view, '__module__', None)
@@ -437,3 +437,14 @@ def limited_parse_qsl(qs, keep_blank_values=False, encoding='utf-8',
437 437
value = unquote(value, encoding=encoding, errors=errors)
438 438
r.append((name, value))
439 439
return r
440 + 441 + 442 +
def escape_leading_slashes(url):
443 +
"""
444 +
If redirecting to an absolute path (two leading slashes), a slash must be
445 +
escaped to prevent browsers from handling the path as schemaless and
446 +
redirecting to another host.
447 +
"""
448 +
if url.startswith('//'):
449 +
url = '/%2F{}'.format(url[2:])
450 +
return url
Original file line number Diff line number Diff line change
@@ -5,3 +5,16 @@ Django 1.11.15 release notes
5 5
*August 1, 2018*
6 6 7 7
Django 1.11.15 fixes a security issue in 1.11.14.
8 + 9 +
CVE-2018-14574: Open redirect possibility in ``CommonMiddleware``
10 +
=================================================================
11 + 12 +
If the :class:`~django.middleware.common.CommonMiddleware` and the
13 +
:setting:`APPEND_SLASH` setting are both enabled, and if the project has a
14 +
URL pattern that accepts any path ending in a slash (many content management
15 +
systems have such a pattern), then a request to a maliciously crafted URL of
16 +
that site could lead to a redirect to another site, enabling phishing and other
17 +
attacks.
18 + 19 +
``CommonMiddleware`` now escapes leading slashes to prevent redirects to other
20 +
domains.
Original file line number Diff line number Diff line change
@@ -6,6 +6,19 @@ Django 2.0.8 release notes
6 6 7 7
Django 2.0.8 fixes a security issue and several bugs in 2.0.7.
8 8 9 +
CVE-2018-14574: Open redirect possibility in ``CommonMiddleware``
10 +
=================================================================
11 + 12 +
If the :class:`~django.middleware.common.CommonMiddleware` and the
13 +
:setting:`APPEND_SLASH` setting are both enabled, and if the project has a
14 +
URL pattern that accepts any path ending in a slash (many content management
15 +
systems have such a pattern), then a request to a maliciously crafted URL of
16 +
that site could lead to a redirect to another site, enabling phishing and other
17 +
attacks.
18 + 19 +
``CommonMiddleware`` now escapes leading slashes to prevent redirects to other
20 +
domains.
21 + 9 22
Bugfixes
10 23
========
11 24
@@ -133,6 +133,25 @@ def test_append_slash_quoted(self):
133 133
self.assertEqual(r.status_code, 301)
134 134
self.assertEqual(r.url, '/needsquoting%23/')
135 135 136 +
@override_settings(APPEND_SLASH=True)
137 +
def test_append_slash_leading_slashes(self):
138 +
"""
139 +
Paths starting with two slashes are escaped to prevent open redirects.
140 +
If there's a URL pattern that allows paths to start with two slashes, a
141 +
request with path //evil.com must not redirect to //evil.com/ (appended
142 +
slash) which is a schemaless absolute URL. The browser would navigate
143 +
to evil.com/.
144 +
"""
145 +
# Use 4 slashes because of RequestFactory behavior.
146 +
request = self.rf.get('////evil.com/security')
147 +
response = HttpResponseNotFound()
148 +
r = CommonMiddleware().process_request(request)
149 +
self.assertEqual(r.status_code, 301)
150 +
self.assertEqual(r.url, '/%2Fevil.com/security/')
151 +
r = CommonMiddleware().process_response(request, response)
152 +
self.assertEqual(r.status_code, 301)
153 +
self.assertEqual(r.url, '/%2Fevil.com/security/')
154 + 136 155
@override_settings(APPEND_SLASH=False, PREPEND_WWW=True)
137 156
def test_prepend_www(self):
138 157
request = self.rf.get('/path/')
@@ -6,4 +6,6 @@
6 6
url(r'^noslash$', views.empty_view),
7 7
url(r'^slash/$', views.empty_view),
8 8
url(r'^needsquoting#/$', views.empty_view),
9 +
# Accepts paths with two leading slashes.
10 +
url(r'^(.+)/security/$', views.empty_view),
9 11
]
Original file line number Diff line number Diff line change
@@ -6,10 +6,10 @@
6 6
from django.utils.datastructures import MultiValueDict
7 7
from django.utils.deprecation import RemovedInDjango21Warning
8 8
from django.utils.http import (
9 -
base36_to_int, cookie_date, http_date, int_to_base36, is_safe_url,
10 -
is_same_domain, parse_etags, parse_http_date, quote_etag, urlencode,
11 -
urlquote, urlquote_plus, urlsafe_base64_decode, urlsafe_base64_encode,
12 -
urlunquote, urlunquote_plus,
9 +
base36_to_int, cookie_date, escape_leading_slashes, http_date,
10 +
int_to_base36, is_safe_url, is_same_domain, parse_etags, parse_http_date,
11 +
quote_etag, urlencode, urlquote, urlquote_plus, urlsafe_base64_decode,
12 +
urlsafe_base64_encode, urlunquote, urlunquote_plus,
13 13
)
14 14 15 15
@@ -275,3 +275,14 @@ def test_parsing_rfc850(self):
275 275
def test_parsing_asctime(self):
276 276
parsed = parse_http_date('Sun Nov 6 08:49:37 1994')
277 277
self.assertEqual(datetime.utcfromtimestamp(parsed), datetime(1994, 11, 6, 8, 49, 37))
278 + 279 + 280 +
class EscapeLeadingSlashesTests(unittest.TestCase):
281 +
def test(self):
282 +
tests = (
283 +
('//example.com', '/%2Fexample.com'),
284 +
('//', '/%2F'),
285 +
)
286 +
for url, expected in tests:
287 +
with self.subTest(url=url):
288 +
self.assertEqual(escape_leading_slashes(url), expected)
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4