Attachment 926625 Details for Bug 1129950 – 1.6 patch

[patch] 1.6 patch

reverse-1.6.diff (text/plain), 5.29 KB, created by Murray McAllister on 2014-08-14 04:40:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Murray McAllister

Created: 2014-08-14 04:40:31 UTC

Size: 5.29 KB

patch

obsolete

>commit 9043ca9a87cb8b485601d8a65e28cdc295efd31a
>Author: Florian Apolloner <florian@apolloner.eu>
>Date:   Thu Jul 17 21:59:28 2014 +0200
>
>    [1.6.x] Prevented reverse() from generating URLs pointing to other hosts.
>    
>    This is a security fix. Disclosure following shortly.
>
>diff --git a/django/core/urlresolvers.py b/django/core/urlresolvers.py
>index b3008e8..4f251ab 100644
>--- a/django/core/urlresolvers.py
>+++ b/django/core/urlresolvers.py
>@@ -435,7 +435,11 @@ class RegexURLResolver(LocaleRegexProvider):
>                 candidate_pat = prefix_norm.replace('%', '%%') + result
>                 if re.search('^%s%s' % (prefix_norm, pattern), candidate_pat % candidate_subs, re.UNICODE):
>                     candidate_subs = dict((k, urlquote(v)) for (k, v) in candidate_subs.items())
>-                    return candidate_pat % candidate_subs
>+                    url = candidate_pat % candidate_subs
>+                    # Don't allow construction of scheme relative urls.
>+                    if url.startswith('//'):
>+                        url = '/%%2F%s' % url[2:]
>+                    return url
>         # lookup_view can be URL label, or dotted path, or callable, Any of
>         # these can be passed in at the top, but callables are not friendly in
>         # error messages.
>diff --git a/docs/releases/1.4.14.txt b/docs/releases/1.4.14.txt
>index d0032e5..28390c9 100644
>--- a/docs/releases/1.4.14.txt
>+++ b/docs/releases/1.4.14.txt
>@@ -5,3 +5,16 @@ Django 1.4.14 release notes
> *Under development*
> 
> Django 1.4.14 fixes several security issues in 1.4.13.
>+
>+:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
>+=======================================================================================
>+
>+In certain situations, URL reversing could generate scheme-relative URLs  (URLs
>+starting with two slashes), which could unexpectedly redirect a user  to a
>+different host. An attacker could exploit this, for example, by redirecting
>+users to a phishing site designed to ask for user's passwords.
>+
>+To remedy this, URL reversing now ensures that no URL starts with two slashes
>+(//), replacing the second slash with its URL encoded counterpart (%2F). This
>+approach ensures that semantics stay the same, while making the URL relative to
>+the domain and not to the scheme.
>diff --git a/docs/releases/1.5.9.txt b/docs/releases/1.5.9.txt
>index 4a5233a..12b5b5f 100644
>--- a/docs/releases/1.5.9.txt
>+++ b/docs/releases/1.5.9.txt
>@@ -5,3 +5,16 @@ Django 1.5.9 release notes
> *Under development*
> 
> Django 1.5.9 fixes several security issues in 1.5.8.
>+
>+:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
>+=======================================================================================
>+
>+In certain situations, URL reversing could generate scheme-relative URLs  (URLs
>+starting with two slashes), which could unexpectedly redirect a user  to a
>+different host. An attacker could exploit this, for example, by redirecting
>+users to a phishing site designed to ask for user's passwords.
>+
>+To remedy this, URL reversing now ensures that no URL starts with two slashes
>+(//), replacing the second slash with its URL encoded counterpart (%2F). This
>+approach ensures that semantics stay the same, while making the URL relative to
>+the domain and not to the scheme.
>diff --git a/docs/releases/1.6.6.txt b/docs/releases/1.6.6.txt
>index f16dab1..87606ea 100644
>--- a/docs/releases/1.6.6.txt
>+++ b/docs/releases/1.6.6.txt
>@@ -6,6 +6,19 @@ Django 1.6.6 release notes
> 
> Django 1.6.6 fixes several security issues and bugs in 1.6.5.
> 
>+:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
>+=======================================================================================
>+
>+In certain situations, URL reversing could generate scheme-relative URLs  (URLs
>+starting with two slashes), which could unexpectedly redirect a user  to a
>+different host. An attacker could exploit this, for example, by redirecting
>+users to a phishing site designed to ask for user's passwords.
>+
>+To remedy this, URL reversing now ensures that no URL starts with two slashes
>+(//), replacing the second slash with its URL encoded counterpart (%2F). This
>+approach ensures that semantics stay the same, while making the URL relative to
>+the domain and not to the scheme.
>+
> Bugfixes
> ========
> 
>diff --git a/tests/urlpatterns_reverse/tests.py b/tests/urlpatterns_reverse/tests.py
>index 249acc1..7df4acf 100644
>--- a/tests/urlpatterns_reverse/tests.py
>+++ b/tests/urlpatterns_reverse/tests.py
>@@ -147,6 +147,9 @@ test_data = (
>     ('defaults', '/defaults_view2/3/', [], {'arg1': 3, 'arg2': 2}),
>     ('defaults', NoReverseMatch, [], {'arg1': 3, 'arg2': 3}),
>     ('defaults', NoReverseMatch, [], {'arg2': 1}),
>+
>+    # Security tests
>+    ('security', '/%2Fexample.com/security/', ['/example.com'], {}),
> )
> 
> class NoURLPatternsTests(TestCase):
>diff --git a/tests/urlpatterns_reverse/urls.py b/tests/urlpatterns_reverse/urls.py
>index ac112c6..74c881e 100644
>--- a/tests/urlpatterns_reverse/urls.py
>+++ b/tests/urlpatterns_reverse/urls.py
>@@ -71,4 +71,7 @@ urlpatterns = patterns('',
>     (r'defaults_view2/(?P<arg1>\d+)/', 'defaults_view', {'arg2': 2}, 'defaults'),
> 
>     url('^includes/', include(other_patterns)),
>+
>+    # Security tests
>+    url('(.+)/security/$', empty_view, name='security'),
> )

Actions: View | Diff

Attachments on bug 1129950: 926622 | 926623 | 926625