diff options
| author | Tim Graham <timograham@gmail.com> | 2017-03-14 10:46:53 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-04-04 10:17:35 -0400 |
| commit | f824655bc2c50b19d2f202d7640785caabc82787 (patch) | |
| tree | 49c8b68f7857263b7441f701efe37b69243f9dd9 /tests | |
| parent | 2a9f6ef71b8e23fd267ee2be1be26dde8ab67037 (diff) | |
[1.10.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.
This is a security fix.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/utils_tests/test_http.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/tests/utils_tests/test_http.py b/tests/utils_tests/test_http.py index e22f76be2e..efe6b9a8b7 100644 --- a/tests/utils_tests/test_http.py +++ b/tests/utils_tests/test_http.py @@ -104,6 +104,8 @@ class TestUtilsHttp(unittest.TestCase): r'http://testserver\me:pass@example.com', r'http://testserver\@example.com', r'http:\\testserver\confirm\me@example.com', + 'http:999999999', + 'ftp:9999999999', '\n', ) for bad_url in bad_urls: @@ -119,6 +121,7 @@ class TestUtilsHttp(unittest.TestCase): '//testserver/', 'http://testserver/confirm?email=me@example.com', '/url%20with%20spaces/', + 'path/http:2222222222', ) for good_url in good_urls: self.assertTrue(http.is_safe_url(good_url, host='testserver'), "%s should be allowed" % good_url) |