#32843: Some CSRF tests don't set request.method
-------------------------------------+-------------------------------------
Reporter: Chris | Owner: Chris Jerdonek
Jerdonek |
Type: | Status: assigned
Cleanup/optimization |
Component: CSRF | Version: dev
Severity: Normal | Keywords:
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
I noticed that for some CSRF tests, `request.method` is `None` when the
test thinks it should be `GET`. This causes
`CsrfViewMiddleware.process_view()` to take a different code path and
treat the request as unsafe because the method isn't in its allowed list:
https://github.com/django/django/blob/316cc34d046ad86e100227772294f906fae1c2e5/django/middleware/csrf.py#L338-L339
The cause for this is that neither implementation of
`_get_GET_csrf_cookie_request()` sets `req.method`. See
[https://github.com/django/django/blob/316cc34d046ad86e100227772294f906fae1c2e5/tests/csrf_tests/tests.py#L773-L779
here] and
[https://github.com/django/django/blob/316cc34d046ad86e100227772294f906fae1c2e5/tests/csrf_tests/tests.py#L971-L977
here].
The tests affected are:
*
`csrf_tests.tests.CsrfViewMiddlewareTests.test_get_token_for_requires_csrf_token_view`
*
`csrf_tests.tests.CsrfViewMiddlewareTests.test_token_node_with_csrf_cookie`
*
`csrf_tests.tests.CsrfViewMiddlewareUseSessionsTests.test_get_token_for_requires_csrf_token_view`
*
`csrf_tests.tests.CsrfViewMiddlewareUseSessionsTests.test_token_node_with_csrf_cookie`
Fortunately, the tests still pass when `request.method` is set to `GET`.
--
Ticket URL: <https://code.djangoproject.com/ticket/32843>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.d88cc53f092b2d183e4ccc2651e00443%40djangoproject.com.
