From dfe495fbe8e360ee3b3cd8b29e55ee19d86fc9d2 Mon Sep 17 00:00:00 2001 From: Honza Král Date: Mon, 12 Oct 2009 10:16:17 +0000 Subject: [soc2009/model-validation] Merged to trunk at r11603 SECURITY ALERT: Corrected regular expressions for URL and email fields. git-svn-id: http://code.djangoproject.com/svn/django/branches/soc2009/model-validation@11617 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- .../admin_views/fixtures/admin-views-person.xml | 2 +- tests/regressiontests/admin_views/tests.py | 3 +- tests/regressiontests/decorators/tests.py | 70 +++++++++++++++++++++- tests/regressiontests/forms/fields.py | 23 +++++++ 4 files changed, 93 insertions(+), 5 deletions(-) (limited to 'tests/regressiontests') diff --git a/tests/regressiontests/admin_views/fixtures/admin-views-person.xml b/tests/regressiontests/admin_views/fixtures/admin-views-person.xml index 77928a834b..ff00fd2169 100644 --- a/tests/regressiontests/admin_views/fixtures/admin-views-person.xml +++ b/tests/regressiontests/admin_views/fixtures/admin-views-person.xml @@ -6,7 +6,7 @@ True - Grace Hooper + Grace Hopper 1 False diff --git a/tests/regressiontests/admin_views/tests.py b/tests/regressiontests/admin_views/tests.py index 669755051e..7273d3f320 100644 --- a/tests/regressiontests/admin_views/tests.py +++ b/tests/regressiontests/admin_views/tests.py @@ -908,7 +908,7 @@ class AdminViewListEditable(TestCase): self.client.post('/test_admin/admin/admin_views/person/', data) self.failUnlessEqual(Person.objects.get(name="John Mauchly").alive, False) - self.failUnlessEqual(Person.objects.get(name="Grace Hooper").gender, 2) + self.failUnlessEqual(Person.objects.get(name="Grace Hopper").gender, 2) # test a filtered page data = { @@ -1616,4 +1616,3 @@ class NeverCacheTests(TestCase): "Check the never-cache status of the Javascript i18n view" response = self.client.get('/test_admin/jsi18n/') self.failUnlessEqual(get_max_age(response), None) - diff --git a/tests/regressiontests/decorators/tests.py b/tests/regressiontests/decorators/tests.py index 3c58637f1a..b81a5d665a 100644 --- a/tests/regressiontests/decorators/tests.py +++ b/tests/regressiontests/decorators/tests.py @@ -1,11 +1,16 @@ from unittest import TestCase from sys import version_info +try: + from functools import wraps +except ImportError: + from django.utils.functional import wraps # Python 2.3, 2.4 fallback. -from django.http import HttpResponse +from django.http import HttpResponse, HttpRequest from django.utils.functional import allow_lazy, lazy, memoize from django.views.decorators.http import require_http_methods, require_GET, require_POST from django.views.decorators.vary import vary_on_headers, vary_on_cookie from django.views.decorators.cache import cache_page, never_cache, cache_control +from django.utils.decorators import auto_adapt_to_methods from django.contrib.auth.decorators import login_required, permission_required, user_passes_test from django.contrib.admin.views.decorators import staff_member_required @@ -84,4 +89,65 @@ class DecoratorsTest(TestCase): response = callback(request) self.assertEqual(response, ['test2', 'test1']) - + + def test_cache_page_new_style(self): + """ + Test that we can call cache_page the new way + """ + def my_view(request): + return "response" + my_view_cached = cache_page(123)(my_view) + self.assertEqual(my_view_cached(HttpRequest()), "response") + my_view_cached2 = cache_page(123, key_prefix="test")(my_view) + self.assertEqual(my_view_cached2(HttpRequest()), "response") + + def test_cache_page_old_style(self): + """ + Test that we can call cache_page the old way + """ + def my_view(request): + return "response" + my_view_cached = cache_page(my_view, 123) + self.assertEqual(my_view_cached(HttpRequest()), "response") + my_view_cached2 = cache_page(my_view, 123, key_prefix="test") + self.assertEqual(my_view_cached2(HttpRequest()), "response") + +class MethodDecoratorAdapterTests(TestCase): + def test_auto_adapt_to_methods(self): + """ + Test that auto_adapt_to_methods actually works. + """ + # Need 2 decorators with auto_adapt_to_methods, + # to check it plays nicely with composing itself. + + def my_decorator(func): + def wrapped(*args, **kwargs): + # need to ensure that the first arg isn't 'self' + self.assertEqual(args[0], "test") + return "my_decorator:" + func(*args, **kwargs) + wrapped.my_decorator_custom_attribute = True + return wraps(func)(wrapped) + my_decorator = auto_adapt_to_methods(my_decorator) + + def my_decorator2(func): + def wrapped(*args, **kwargs): + # need to ensure that the first arg isn't 'self' + self.assertEqual(args[0], "test") + return "my_decorator2:" + func(*args, **kwargs) + wrapped.my_decorator2_custom_attribute = True + return wraps(func)(wrapped) + my_decorator2 = auto_adapt_to_methods(my_decorator2) + + class MyClass(object): + def my_method(self, *args, **kwargs): + return "my_method:%r %r" % (args, kwargs) + my_method = my_decorator2(my_decorator(my_method)) + + obj = MyClass() + self.assertEqual(obj.my_method("test", 123, name='foo'), + "my_decorator2:my_decorator:my_method:('test', 123) {'name': 'foo'}") + self.assertEqual(obj.my_method.__name__, 'my_method') + self.assertEqual(getattr(obj.my_method, 'my_decorator_custom_attribute', False), + True) + self.assertEqual(getattr(obj.my_method, 'my_decorator2_custom_attribute', False), + True) diff --git a/tests/regressiontests/forms/fields.py b/tests/regressiontests/forms/fields.py index 2efe72d02c..b02b4612a2 100644 --- a/tests/regressiontests/forms/fields.py +++ b/tests/regressiontests/forms/fields.py @@ -381,6 +381,17 @@ class TestFields(TestCase): self.assertEqual(u'example@valid-----hyphens.com', f.clean('example@valid-----hyphens.com')) self.assertEqual(u'example@valid-with-hyphens.com', f.clean('example@valid-with-hyphens.com')) + def test_email_regexp_for_performance(self): + f = EmailField() + # Check for runaway regex security problem. This will take for-freeking-ever + # if the security fix isn't in place. + self.assertRaisesErrorWithMessage( + ValidationError, + "[u'Enter a valid e-mail address.']", + f.clean, + 'viewx3dtextx26qx3d@yahoo.comx26latlngx3d15854521645943074058' + ) + def test_emailfield_33(self): f = EmailField(required=False) self.assertEqual(u'', f.clean('')) @@ -431,6 +442,7 @@ class TestFields(TestCase): self.assertRaisesErrorWithMessage(ValidationError, "[u'This field is required.']", f.clean, None) self.assertEqual(u'http://localhost/', f.clean('http://localhost')) self.assertEqual(u'http://example.com/', f.clean('http://example.com')) + self.assertEqual(u'http://example.com./', f.clean('http://example.com.')) self.assertEqual(u'http://www.example.com/', f.clean('http://www.example.com')) self.assertEqual(u'http://www.example.com:8000/test', f.clean('http://www.example.com:8000/test')) self.assertEqual(u'http://valid-with-hyphens.com/', f.clean('valid-with-hyphens.com')) @@ -441,6 +453,8 @@ class TestFields(TestCase): self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://') self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://example') self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://example.') + self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'com.') + self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, '.') self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://.com') self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://invalid-.com') self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://-invalid.com') @@ -448,6 +462,15 @@ class TestFields(TestCase): self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://inv-.-alid.com') self.assertEqual(u'http://valid-----hyphens.com/', f.clean('http://valid-----hyphens.com')) + def test_url_regexp_for_performance(self): + f = URLField() + # hangs "forever" if catastrophic backtracking in ticket:#11198 not fixed + self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://%s' % ("X"*200,)) + + # a second test, to make sure the problem is really addressed, even on + # domains that don't fail the domain label length check in the regex + self.assertRaisesErrorWithMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://%s' % ("X"*60,)) + def test_urlfield_38(self): f = URLField(required=False) self.assertEqual(u'', f.clean('')) -- cgit v1.3