diff options
| author | Tim Graham <timograham@gmail.com> | 2017-03-14 10:46:53 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-04-04 10:46:50 -0400 |
| commit | 97e77b7bc14eafda704a01881cb2a3dc164947bc (patch) | |
| tree | 23f97be3d3a43b51b63447cae8a54f5f6cee0ea2 /tests/utils_tests | |
| parent | 001ff508081a893d0cf81df1214dbd234606c360 (diff) | |
[1.11.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.
This is a security fix.
Diffstat (limited to 'tests/utils_tests')
| -rw-r--r-- | tests/utils_tests/test_http.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py index e90d5e397d..f6f711c72f 100644 --- a/tests/utils_tests/test_http.py +++ b/tests/utils_tests/test_http.py @@ -106,6 +106,8 @@ class TestUtilsHttp(unittest.TestCase): r'http://testserver\me:pass@example.com', r'http://testserver\@example.com', r'http:\\testserver\confirm\me@example.com', + 'http:999999999', + 'ftp:9999999999', '\n', ) for bad_url in bad_urls: @@ -126,6 +128,7 @@ class TestUtilsHttp(unittest.TestCase): '//testserver/', 'http://testserver/confirm?email=me@example.com', '/url%20with%20spaces/', + 'path/http:2222222222', ) for good_url in good_urls: with ignore_warnings(category=RemovedInDjango21Warning): |