From d618d7ae4fec727d5b582bd24f803c28d17bf7cd Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Tue, 12 May 2026 16:29:56 +0100 Subject: Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware. Thanks Ahmed Badawe for the report, and Jacob Walls for reviews. --- tests/cache/tests.py | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'tests') diff --git a/tests/cache/tests.py b/tests/cache/tests.py index 65ca885125..d4cfadb050 100644 --- a/tests/cache/tests.py +++ b/tests/cache/tests.py @@ -2851,15 +2851,19 @@ class CacheMiddlewareTest(SimpleTestCase): Responses with 'Cache-Control: private/no-cache/no-store' are not cached. """ - for cc in ("private", "no-cache", "no-store"): + for cc in ("private", "no-cache", "no-store", "PRIVATE", "NO-store"): with self.subTest(cache_control=cc): - view_with_cache = cache_page(3)( - cache_control(**{cc: True})(hello_world_view) - ) + # Cannot use @cache_control() as it lowercases directives. + @cache_page(3) + def view(request, value): + return HttpResponse( + f"Hello World {value}", headers={"Cache-Control": cc} + ) + request = self.factory.get("/view/") - response = view_with_cache(request, "1") + response = view(request, "1") self.assertEqual(response.content, b"Hello World 1") - response = view_with_cache(request, "2") + response = view(request, "2") self.assertEqual(response.content, b"Hello World 2") def test_vary_asterisk_not_cached(self): -- cgit v1.3