From 2da4ace0bc1bc1d79bf43b368cb857f6f0cd6b1b Mon Sep 17 00:00:00 2001
From: Florian Apolloner <florian@apolloner.eu>
Date: Tue, 27 Nov 2012 22:27:14 +0100
Subject: [1.3.X] Fixed a security issue in get_host.

Full disclosure and new release forthcoming.
---
 django/http/__init__.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'django')

diff --git a/django/http/__init__.py b/django/http/__init__.py
index dddd9a89c4..a80750b57c 100644
--- a/django/http/__init__.py
+++ b/django/http/__init__.py
@@ -129,6 +129,8 @@ from utils import *
 RESERVED_CHARS="!*'();:@&=+$,/?%#[]"
 
 absolute_http_url_re = re.compile(r"^https?://", re.I)
+host_validation_re = re.compile(r"^([a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9:]+\])(:\d+)?$")
+
 
 class Http404(Exception):
     pass
@@ -167,7 +169,7 @@ class HttpRequest(object):
                 host = '%s:%s' % (host, server_port)
 
         # Disallow potentially poisoned hostnames.
-        if set(';/?@&=+$,').intersection(host):
+        if not host_validation_re.match(host.lower()):
             raise SuspiciousOperation('Invalid HTTP_HOST header: %s' % host)
 
         return host
-- 
cgit v1.3