#31375: make_password shouldn't accept values other than bytes or string as an
argument
------------------------------+--------------------------------------
Reporter: iamdavidcz | Owner: nobody
Type: Bug | Status: new
Component: contrib.auth | Version: 3.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------
Description changed by iamdavidcz:
Old description:
> Currently `make_password` function accepts almost every Python object as
> an argument. This is a strange behaviour and it results directly from
> `force_bytes` casting objects to `str`. We should throw the `TypeError`
> when passing anything but `bytes` or `str` to `make_password`.
>
> **Reasons:**
>
> - users unaware of this strange behaviour can accidentally create weak
> passwords (potential security issue)
> - other libraries throw the `TypeError` in the same cases (eg. Werkzeug,
> passlib)
> - it's inconsistent with the documentation that says:
> > It takes one mandatory argument: the password in plain-text.
> - it's inconsistent with `validate_password` behaviour (passing anything
> but `bytes` or `str` to `validate_password` raises the `TypeError` with
> default `settings.AUTH_PASSWORD_VALIDATORS`).
>
> **Discussion:**
>
> https://groups.google.com/forum/#!topic/django-developers/1Ap0zDjFa4E
New description:
Currently `make_password` function accepts almost every Python object as
an argument. This is a strange behaviour and it results directly from
`force_bytes` casting objects to `str`. We should throw the `TypeError`
when passing anything but `bytes` or `str` to `make_password`.
**Reasons:**
- programmers unaware of this strange behaviour can accidentally create
weak passwords (potential security issue)
- other libraries raise the `TypeError` in the same cases (eg. Werkzeug,
passlib)
- it's inconsistent with the documentation that says:
> It takes one mandatory argument: the password in plain-text.
- it's inconsistent with `validate_password` behaviour (passing anything
but `bytes` or `str` to `validate_password` raises the `TypeError` with
default `settings.AUTH_PASSWORD_VALIDATORS`).
**Discussion:**
https://groups.google.com/forum/#!topic/django-developers/1Ap0zDjFa4E
--
--
Ticket URL: <https://code.djangoproject.com/ticket/31375#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.36d798ff3164a8d6ee1cf9918d6e6f95%40djangoproject.com.
