p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.1.X] Fixed a security issue in the file session backend. Disclosure and new release forthcoming. 

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15469 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Alex Gaynor 2011-02-09 02:14:24 +00:00
parent 408c5c873c
commit 570a32a047
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
django/contrib/sessions/backends/file.py
View File

@ -26,6 +26,8 @@ class SessionStore(SessionBase):
self.file_prefix = settings.SESSION_COOKIE_NAME self.file_prefix = settings.SESSION_COOKIE_NAME
super(SessionStore, self).__init__(session_key) super(SessionStore, self).__init__(session_key)
VALID_KEY_CHARS = set("abcdef0123456789")
def _key_to_file(self, session_key=None): def _key_to_file(self, session_key=None):
""" """
Get the file associated with this session key. Get the file associated with this session key.
@ -36,9 +38,9 @@ class SessionStore(SessionBase):
# Make sure we're not vulnerable to directory traversal. Session keys # Make sure we're not vulnerable to directory traversal. Session keys
# should always be md5s, so they should never contain directory # should always be md5s, so they should never contain directory
# components. # components.
if os.path.sep in session_key: if not set(session_key).issubset(self.VALID_KEY_CHARS):
raise SuspiciousOperation( raise SuspiciousOperation(
"Invalid characters (directory components) in session key") "Invalid characters in session key")
return os.path.join(self.storage_path, self.file_prefix + session_key) return os.path.join(self.storage_path, self.file_prefix + session_key)

11
django/contrib/sessions/tests.py
View File

@ -129,6 +129,17 @@ True
>>> file_session = FileSession(file_session.session_key) >>> file_session = FileSession(file_session.session_key)
>>> file_session.save() >>> file_session.save()
# Ensure we don't allow directory traversal
>>> FileSession("a/b/c").load()
Traceback (innermost last):
...
SuspiciousOperation: Invalid characters in session key
>>> FileSession("a\\b\\c").load()
Traceback (innermost last):
...
SuspiciousOperation: Invalid characters in session key
# Make sure the file backend checks for a good storage dir # Make sure the file backend checks for a good storage dir
>>> settings.SESSION_FILE_PATH = "/if/this/directory/exists/you/have/a/weird/computer" >>> settings.SESSION_FILE_PATH = "/if/this/directory/exists/you/have/a/weird/computer"
>>> FileSession() >>> FileSession()