From 552f03869ea7f3072b3fa19ffb6cb2d957fd8447 Mon Sep 17 00:00:00 2001 From: Claude Paroz Date: Fri, 4 Mar 2016 23:33:35 +0100 Subject: Added safety to URL decoding in is_safe_url() on Python 2 The errors='replace' parameter to force_text altered the URL before checking it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef. --- django/utils/http.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'django/utils') diff --git a/django/utils/http.py b/django/utils/http.py index 40a7d5f083..ba814504ad 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -291,7 +291,10 @@ def is_safe_url(url, host=None): if not url: return False if six.PY2: - url = force_text(url, errors='replace') + try: + url = force_text(url) + except UnicodeDecodeError: + return False # Chrome treats \ completely as / in paths but it could be part of some # basic auth credentials so we need to check both URLs. return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host) -- cgit v1.3