+19
-3
lines changedFilter options
+19
-3
lines changed Original file line number Diff line number Diff line change
@@ -50,3 +50,14 @@ def _today(self):
50 50 51 51
p2 = Mocked(date.today() + timedelta(settings.PASSWORD_RESET_TIMEOUT_DAYS + 1))
52 52
self.assertFalse(p2.check_token(user, tk1))
53 + 54 +
def test_date_length(self):
55 +
"""
56 +
Make sure we don't allow overly long dates, causing a potential DoS.
57 +
"""
58 +
user = User.objects.create_user('ima1337h4x0r', 'test4@example.com', 'p4ssw0rd')
59 +
p0 = PasswordResetTokenGenerator()
60 + 61 +
# This will put a 14-digit base36 timestamp into the token, which is too large.
62 +
tk1 = p0._make_token_with_timestamp(user, 175455491841851871349)
63 +
self.assertFalse(p0.check_token(user, tk1))
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
1 -
# These URLs are normally mapped to /admin/urls.py. This URLs file is
1 +
# These URLs are normally mapped to /admin/urls.py. This URLs file is
2 2
# provided as a convenience to those who want to deploy these URLs elsewhere.
3 3
# This file is also used to provide a reliable view deployment for test purposes.
4 4
@@ -11,7 +11,7 @@
11 11
(r'^password_change/done/$', 'django.contrib.auth.views.password_change_done'),
12 12
(r'^password_reset/$', 'django.contrib.auth.views.password_reset'),
13 13
(r'^password_reset/done/$', 'django.contrib.auth.views.password_reset_done'),
14 -
(r'^reset/(?P<uidb36>[0-9A-Za-z]+)-(?P<token>.+)/$', 'django.contrib.auth.views.password_reset_confirm'),
14 +
(r'^reset/(?P<uidb36>[0-9A-Za-z]{1,13})-(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$', 'django.contrib.auth.views.password_reset_confirm'),
15 15
(r'^reset/done/$', 'django.contrib.auth.views.password_reset_complete'),
16 16
)
17 17
@@ -73,8 +73,13 @@ def http_date(epoch_seconds=None):
73 73 74 74
def base36_to_int(s):
75 75
"""
76 -
Convertd a base 36 string to an integer
76 +
Converts a base 36 string to an ``int``. To prevent
77 +
overconsumption of server resources, raises ``ValueError` if the
78 +
input is longer than 13 base36 digits (13 digits is sufficient to
79 +
base36-encode any 64-bit integer).
77 80
"""
81 +
if len(s) > 13:
82 +
raise ValueError("Base36 input too large")
78 83
return int(s, 36)
79 84 80 85
def int_to_base36(i):
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4