From 2342693b31f740a422abf7267c53b4e7bc487c1b Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Mon, 9 Mar 2015 20:05:13 -0400 Subject: [1.4.x] Made is_safe_url() reject URLs that start with control characters. This is a security fix; disclosure to follow shortly. --- tests/regressiontests/utils/http.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'tests/regressiontests/utils/http.py') diff --git a/tests/regressiontests/utils/http.py b/tests/regressiontests/utils/http.py index 3ec237ae64..8245a7e54e 100644 --- a/tests/regressiontests/utils/http.py +++ b/tests/regressiontests/utils/http.py @@ -98,7 +98,9 @@ class TestUtilsHttp(unittest.TestCase): 'http:\/example.com', 'http:/\example.com', 'javascript:alert("XSS")' - '\njavascript:alert(x)'): + '\njavascript:alert(x)', + '\x08//example.com', + '\n'): self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url) for good_url in ('/view/?param=http://example.com', '/view/?param=https://example.com', -- cgit v1.3