Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork7k
Fix potential XSS vulnerability in break_long_headers template filter#9435
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Fix potential XSS vulnerability in break_long_headers template filter#9435
Conversation
The header input is now properly escaped before splitting and joining with <br> tags. This prevents potential XSS attacks if the header contains unsanitized user input.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Probably deserves a test
@browniebroke Let's prioritise getting this sorted, rather than waiting on a test case. I'd marginally prefer#9438 over this, since the line break isn't actually required however we should just go with whatever gets this resolved as quickly as possible at this point. |
3b41f01 intoencode:masterUh oh!
There was an error while loading.Please reload this page.
I've identified a potential XSS vulnerability related to the break_long_headers template filter used in the rest_framework/base.html template file by APIView. This file employs the break_long_headers template filter, making the following code vulnerable to XSS attacks due to unsanitized user input: # views.pyfromrest_framework.viewsimportAPIViewfromrest_framework.responseimportResponseclassIndex(APIView):defget(self,request):username=request.GET.get('username','')response=Response('OK')response['Location']=f'https://x.com/{username}'returnresponse# urls.pyfromdjango.urlsimportpathurlpatterns= [path('api/',Index.as_view()), ] I believe it is essential to register this issue as a CVE to ensure that users of earlier versions of DRF are aware and can manage this vulnerability appropriately. Your thoughts on this? |
…9444)Co-authored-by: Francesco <francesco.cataldo@spinforward.it>
Description
The header input is now properly escaped before splitting and joining with
<br>tags. This prevents potential XSS attacks if the header contains unsanitized user input.This pull request addresses a potential XSS vulnerability in the
break_long_headerstemplate filter. By escaping the header input before processing, the risk of XSS attacks is mitigated.