#31429: Django Client. Empty adding carraige character in body
-------------------------------------+-------------------------------------
Reporter: paulpmi | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: Testing | Version: 3.0
framework | Keywords: carriage-character
Severity: Normal | Django-test security
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
Steps to reproduce:
1. Build endpoint for POST/PUT/PATCH
2. use empty body client.post() on the reverse URL
3. list(request.body) -> ['-', '-', 'B', 'o', 'U', 'n', 'D', 'a', 'R',
'y', 'S', 't', 'R', 'i', 'N', 'g', '-', '-', '\r', '\n']
Issue:
If any security measures as in place \r will always be sanitized. Any
checks done on the requests.body will have to take into account this
atypical case. This is due to how django client does json encoding and
presents a danger.
Proposal:
use the typical json.dumps() instead of the current implementation
--
Ticket URL: <https://code.djangoproject.com/ticket/31429>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.a061f6194f749bbfe93332aea294e717%40djangoproject.com.
