diff options
| author | YashRaj1506 <yashraj504300@gmail.com> | 2025-06-26 03:31:00 +0530 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-10-20 16:22:10 -0300 |
| commit | f5b6ed78200b2cbff71ec771e6f014de5d4abbd8 (patch) | |
| tree | aa170bb7b204c491dea526f28861b048a57b45e0 /tests | |
| parent | c365139af7067df9f026c09e0c02546772549596 (diff) | |
[6.0.x] Fixed #36470 -- Prevented log injection in runserver when handling NOT FOUND.
Migrated `WSGIRequestHandler.log_message()` to use a more robust
`log_message()` helper, which was based of `log_response()` via factoring out
the common bits.
Refs CVE-2025-48432.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 9bb83925d6c231e964f8b54efbc982fb1333da27 from main.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/servers/test_basehttp.py | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/tests/servers/test_basehttp.py b/tests/servers/test_basehttp.py index cc4701114a..9190fc8a20 100644 --- a/tests/servers/test_basehttp.py +++ b/tests/servers/test_basehttp.py @@ -50,6 +50,21 @@ class WSGIRequestHandlerTestCase(SimpleTestCase): cm.records[0].levelname, wrong_level.upper() ) + def test_log_message_escapes_control_sequences(self): + request = WSGIRequest(self.request_factory.get("/").environ) + request.makefile = lambda *args, **kwargs: BytesIO() + handler = WSGIRequestHandler(request, "192.168.0.2", None) + + malicious_path = "\x1b[31mALERT\x1b[0m" + + with self.assertLogs("django.server", "WARNING") as cm: + handler.log_message("GET %s %s", malicious_path, "404") + + log = cm.output[0] + + self.assertNotIn("\x1b[31m", log) + self.assertIn("\\x1b[31mALERT\\x1b[0m", log) + def test_https(self): request = WSGIRequest(self.request_factory.get("/").environ) request.makefile = lambda *args, **kwargs: BytesIO() |