diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2012-11-27 22:19:37 +0100 |
|---|---|---|
| committer | Florian Apolloner <florian@apolloner.eu> | 2012-12-10 22:11:40 +0100 |
| commit | 27560924ec1e567be4727ef8d7dfc4d3879c048c (patch) | |
| tree | 9351c083e25719527e9620f958949bfe970d44dd /django/http | |
| parent | a2f2a399566dd68ce7e312fff5a5ba857066797d (diff) | |
Fixed a security issue in get_host.
Full disclosure and new release forthcoming.
Diffstat (limited to 'django/http')
| -rw-r--r-- | django/http/request.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/django/http/request.py b/django/http/request.py index d3f0888d47..8f74bddb71 100644 --- a/django/http/request.py +++ b/django/http/request.py @@ -25,6 +25,7 @@ from django.utils.encoding import force_bytes, force_text, force_str, iri_to_uri RAISE_ERROR = object() absolute_http_url_re = re.compile(r"^https?://", re.I) +host_validation_re = re.compile(r"^([a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9:]+\])(:\d+)?$") class UnreadablePostError(IOError): @@ -64,7 +65,7 @@ class HttpRequest(object): host = '%s:%s' % (host, server_port) # Disallow potentially poisoned hostnames. - if set(';/?@&=+$,').intersection(host): + if not host_validation_re.match(host.lower()): raise SuspiciousOperation('Invalid HTTP_HOST header: %s' % host) return host |