4 ms·
As others have said, Django may or may not have security issues. I wouldn't bet against it. With regard to this vulnerability, however, the '^' and '$' regex p
by dnerdy 14y ago
As others have said, Django may or may not have security issues. I wouldn't bet against it.
With regard to this vulnerability, however, the '^' and '$' regex pattern characters in python match the beginning and end (or end + '\n') of the string by default. Multiline mode has to be enabled explicitly:
import re
re.match(r'^test$', 'test\n multiline') == None
re.match(r'^test$', 'test\n multiline', re.MULTILINE) != None
So, I think it's a little less likely that this particular vulnerability would be an issue. It's still possible for someone to leave off the '$', but at least that case is a little more obvious.
Also, the Django codebase doesn't have any param processing code that uses whitelisting/blacklisting like this; you have to explicitly lookup values in request.GET and request.POST or use specific field names in a Form. It's a little less convenient compared to mass assignment, but more secure by default.
- shabble 14y agoDjango ModelForms[1] do seem (to my rails-ignorant self) to be quite similar to what's being described here. class SomeForm(ModelForm): class Meta: model = SomeModel fields = [ whitelist ] exclude = [ blacklist ] Both fields and exclude are optional, if neither are specified 'all'[2] fields for the model will be included in the form. [1] https://docs.djangoproject.com/en/1.4/topics/forms/modelforms/#using-a-subset-of-fields-on-the-form https://docs.djangoproject.com/en/1.4/topics/forms/modelform... [2] The model can blacklist certain fields with editable=False in the field definition as well, which afaik trumps anything a ModelForm does.