innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity
django1/django/core
History
Mariusz Felisiak e1e81aa1c4
Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+. 
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603
 		2021-05-06 08:45:23 +02:00
..
cache Fixed #32705 -- Prevented database cache backend from checking .rowcount on closed cursor. 2021-05-05 12:41:59 +02:00
checks Fixed #32678 -- Removed SECURE_BROWSER_XSS_FILTER setting. 2021-04-30 12:32:52 +02:00
files Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:44:42 +02:00
handlers Removed unreachable SystemExit check. 2021-01-19 07:04:53 +01:00
mail Refs #32508 -- Raised Type/ValueError instead of using "assert" in django.core. 2021-03-19 08:04:37 +01:00
management Fixed #32355 -- Dropped support for Python 3.6 and 3.7 2021-02-10 10:20:54 +01:00
serializers Fixed #32420 -- Fixed detecting primary key values in deserialization when PK is also a FK. 2021-02-05 12:33:43 +01:00
servers Fixed #32416 -- Made ThreadedWSGIServer close connections after each thread. 2021-04-12 10:23:56 +02:00
__init__.py
…
asgi.py Fixed #30451 -- Added ASGI handler and coroutine-safety. 2019-06-20 12:29:43 +02:00
exceptions.py Refs #29838, Refs #28507 -- Made make_hashable() ignore key order. 2020-10-05 20:42:46 +02:00
paginator.py Fixed #25513 -- Extracted admin pagination to Paginator.get_elided_page_range(). 2020-08-06 12:38:56 +02:00
signals.py Fixed #31327 -- Deprecated providing_args argument for Signal. 2020-03-05 09:38:52 +01:00
signing.py Refs #31842 -- Removed DEFAULT_HASHING_ALGORITHM transitional setting. 2021-01-14 17:50:04 +01:00
validators.py Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+. 2021-05-06 08:45:23 +02:00
wsgi.py Refs #27656 -- Updated django.core docstring verbs according to PEP 257. 2017-02-21 11:58:42 -05:00