A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/django/django/commit/84b2da5552e100ae3294f564f6c862fef8d0e693 below:

[3.0.x] Fixed CVE-2020-13254 -- Enforced cache key validation in memc… · django/django@84b2da5 · GitHub

4 4

import re

5 5

import time

6 6 7 -

from django.core.cache.backends.base import DEFAULT_TIMEOUT, BaseCache

7 +

from django.core.cache.backends.base import (

8 +

DEFAULT_TIMEOUT, BaseCache, InvalidCacheKey, memcache_key_warnings,

9 +

)

8 10

from django.utils.functional import cached_property

9 11 10 12

@@ -64,24 +66,30 @@ def get_backend_timeout(self, timeout=DEFAULT_TIMEOUT):

64 66 65 67

def add(self, key, value, timeout=DEFAULT_TIMEOUT, version=None):

66 68

key = self.make_key(key, version=version)

69 +

self.validate_key(key)

67 70

return self._cache.add(key, value, self.get_backend_timeout(timeout))

68 71 69 72

def get(self, key, default=None, version=None):

70 73

key = self.make_key(key, version=version)

74 +

self.validate_key(key)

71 75

return self._cache.get(key, default)

72 76 73 77

def set(self, key, value, timeout=DEFAULT_TIMEOUT, version=None):

74 78

key = self.make_key(key, version=version)

79 +

self.validate_key(key)

75 80

if not self._cache.set(key, value, self.get_backend_timeout(timeout)):

76 81

# make sure the key doesn't keep its old value in case of failure to set (memcached's 1MB limit)

77 82

self._cache.delete(key)

78 83 79 84

def delete(self, key, version=None):

80 85

key = self.make_key(key, version=version)

86 +

self.validate_key(key)

81 87

self._cache.delete(key)

82 88 83 89

def get_many(self, keys, version=None):

84 90

key_map = {self.make_key(key, version=version): key for key in keys}

91 +

for key in key_map:

92 +

self.validate_key(key)

85 93

ret = self._cache.get_multi(key_map.keys())

86 94

return {key_map[k]: v for k, v in ret.items()}

87 95

@@ -91,6 +99,7 @@ def close(self, **kwargs):

91 99 92 100

def incr(self, key, delta=1, version=None):

93 101

key = self.make_key(key, version=version)

102 +

self.validate_key(key)

94 103

# memcached doesn't support a negative delta

95 104

if delta < 0:

96 105

return self._cache.decr(key, -delta)

@@ -109,6 +118,7 @@ def incr(self, key, delta=1, version=None):

109 118 110 119

def decr(self, key, delta=1, version=None):

111 120

key = self.make_key(key, version=version)

121 +

self.validate_key(key)

112 122

# memcached doesn't support a negative delta

113 123

if delta < 0:

114 124

return self._cache.incr(key, -delta)

@@ -130,6 +140,7 @@ def set_many(self, data, timeout=DEFAULT_TIMEOUT, version=None):

130 140

original_keys = {}

131 141

for key, value in data.items():

132 142

safe_key = self.make_key(key, version=version)

143 +

self.validate_key(safe_key)

133 144

safe_data[safe_key] = value

134 145

original_keys[safe_key] = key

135 146

failed_keys = self._cache.set_multi(safe_data, self.get_backend_timeout(timeout))

@@ -141,6 +152,10 @@ def delete_many(self, keys, version=None):

141 152

def clear(self):

142 153

self._cache.flush_all()

143 154 155 +

def validate_key(self, key):

156 +

for warning in memcache_key_warnings(key):

157 +

raise InvalidCacheKey(warning)

158 + 144 159 145 160

class MemcachedCache(BaseMemcachedCache):

146 161

"An implementation of a cache binding using python-memcached"


RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4