diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2012-11-27 22:26:29 +0100 |
|---|---|---|
| committer | Florian Apolloner <florian@apolloner.eu> | 2012-12-10 22:14:16 +0100 |
| commit | 319627c184e71ae267d6b7f000e293168c7b6e09 (patch) | |
| tree | 0e48a2084e8ea17b422e6cf3611a49bccfe9517e /django | |
| parent | b2ae0a63aeec741f1e51bac9a95a27fd635f9652 (diff) | |
[1.4.X] Fixed a security issue in get_host.
Full disclosure and new release forthcoming.
Diffstat (limited to 'django')
| -rw-r--r-- | django/http/__init__.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/django/http/__init__.py b/django/http/__init__.py index 98ec9966c4..da993eb8d3 100644 --- a/django/http/__init__.py +++ b/django/http/__init__.py @@ -126,6 +126,8 @@ from django.utils import timezone RESERVED_CHARS="!*'();:@&=+$,/?%#[]" absolute_http_url_re = re.compile(r"^https?://", re.I) +host_validation_re = re.compile(r"^([a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9:]+\])(:\d+)?$") + class Http404(Exception): pass @@ -214,7 +216,7 @@ class HttpRequest(object): host = '%s:%s' % (host, server_port) # Disallow potentially poisoned hostnames. - if set(';/?@&=+$,').intersection(host): + if not host_validation_re.match(host.lower()): raise SuspiciousOperation('Invalid HTTP_HOST header: %s' % host) return host |