diff options
| -rw-r--r-- | django/urls/resolvers.py | 8 | ||||
| -rw-r--r-- | docs/releases/2.2.25.txt | 6 | ||||
| -rw-r--r-- | tests/urlpatterns/tests.py | 13 |
3 files changed, 24 insertions, 3 deletions
diff --git a/django/urls/resolvers.py b/django/urls/resolvers.py index 5b722474c9..3f8f6c00ea 100644 --- a/django/urls/resolvers.py +++ b/django/urls/resolvers.py @@ -147,7 +147,11 @@ class RegexPattern(CheckURLMixin): self.converters = {} def match(self, path): - match = self.regex.search(path) + match = ( + self.regex.fullmatch(path) + if self._is_endpoint and self.regex.pattern.endswith('$') + else self.regex.search(path) + ) if match: # If there are any named groups, use those as kwargs, ignoring # non-named groups. Otherwise, pass all non-named arguments as @@ -230,7 +234,7 @@ def _route_to_regex(route, is_endpoint=False): converters[parameter] = converter parts.append('(?P<' + parameter + '>' + converter.regex + ')') if is_endpoint: - parts.append('$') + parts.append(r'\Z') return ''.join(parts), converters diff --git a/docs/releases/2.2.25.txt b/docs/releases/2.2.25.txt index e8e552d80e..1662451a30 100644 --- a/docs/releases/2.2.25.txt +++ b/docs/releases/2.2.25.txt @@ -6,4 +6,8 @@ Django 2.2.25 release notes Django 2.2.25 fixes a security issue with severity "low" in 2.2.24. -... +CVE-2021-44420: Potential bypass of an upstream access control based on URL paths +================================================================================= + +HTTP requests for URLs with trailing newlines could bypass an upstream access +control based on URL paths. diff --git a/tests/urlpatterns/tests.py b/tests/urlpatterns/tests.py index f696cd531d..38b4392adc 100644 --- a/tests/urlpatterns/tests.py +++ b/tests/urlpatterns/tests.py @@ -116,6 +116,19 @@ class SimplifiedURLTests(SimpleTestCase): with self.assertRaisesMessage(ImproperlyConfigured, msg): path('foo/<nonexistent:var>/', empty_view) + def test_path_trailing_newlines(self): + tests = [ + '/articles/2003/\n', + '/articles/2010/\n', + '/en/foo/\n', + '/included_urls/extra/\n', + '/regex/1/\n', + '/users/1/\n', + ] + for url in tests: + with self.subTest(url=url), self.assertRaises(Resolver404): + resolve(url) + @override_settings(ROOT_URLCONF='urlpatterns.converter_urls') class ConverterTests(SimpleTestCase): |