diff options
| author | Erik Romijn <eromijn@solidlinks.nl> | 2013-05-19 15:25:49 +0200 |
|---|---|---|
| committer | Aymeric Augustin <aymeric.augustin@m4x.org> | 2013-05-19 15:33:05 +0200 |
| commit | f88700d610d69ba5b44ab7b0692f8792aab3b54b (patch) | |
| tree | 234ae1d6fd1e98fafd9fd9b5ac13d318ad2e366f | |
| parent | a9b98f59aaff3f7281fedb27563a263dbb7753ec (diff) | |
Fix #19664 -- Illegal Characters In Session Key Give Fatal Error On File Backend Only
| -rw-r--r-- | AUTHORS | 1 | ||||
| -rw-r--r-- | django/contrib/sessions/backends/file.py | 2 | ||||
| -rw-r--r-- | django/contrib/sessions/tests.py | 13 |
3 files changed, 12 insertions, 4 deletions
@@ -492,6 +492,7 @@ answer newbie questions, and generally made Django that much better: Alex Robbins <alexander.j.robbins@gmail.com> Matt Robenolt <m@robenolt.com> Henrique Romano <onaiort@gmail.com> + Erik Romijn <django@solidlinks.nl> Armin Ronacher Daniel Roseman <http://roseman.org.uk/> Rozza <ross.lawley@gmail.com> diff --git a/django/contrib/sessions/backends/file.py b/django/contrib/sessions/backends/file.py index 9588680fea..3c3408e9a8 100644 --- a/django/contrib/sessions/backends/file.py +++ b/django/contrib/sessions/backends/file.py @@ -86,7 +86,7 @@ class SessionStore(SessionBase): session_data = {} self.delete() self.create() - except IOError: + except (IOError, SuspiciousOperation): self.create() return session_data diff --git a/django/contrib/sessions/tests.py b/django/contrib/sessions/tests.py index 8bcc505ee6..1a7286e77e 100644 --- a/django/contrib/sessions/tests.py +++ b/django/contrib/sessions/tests.py @@ -403,14 +403,21 @@ class FileSessionTests(SessionTestsMixin, unittest.TestCase): self.assertRaises(ImproperlyConfigured, self.backend) def test_invalid_key_backslash(self): - # Ensure we don't allow directory-traversal + # This key should be refused and a new session should be created + self.assertTrue(self.backend("a\\b\\c").load()) + + def test_invalid_key_backslash(self): + # Ensure we don't allow directory-traversal. + # This is tested directly on _key_to_file, as load() will swallow + # a SuspiciousOperation in the same way as an IOError - by creating + # a new session, making it unclear whether the slashes were detected. self.assertRaises(SuspiciousOperation, - self.backend("a\\b\\c").load) + self.backend()._key_to_file, "a\\b\\c") def test_invalid_key_forwardslash(self): # Ensure we don't allow directory-traversal self.assertRaises(SuspiciousOperation, - self.backend("a/b/c").load) + self.backend()._key_to_file, "a/b/c") @override_settings(SESSION_ENGINE="django.contrib.sessions.backends.file") def test_clearsessions_command(self): |