imacat/mia-accounting
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 40 Wiki Activity

Removed the size restriction in the next URI utilities. Buffer overflow may happen with any parameter, not only the "next" parameter. It should be solved in uWSGI, but not the application.

Browse Source
This commit is contained in:
依瑪貓 2023-05-18 23:30:36 +08:00
parent abe90d3483
commit b397515457
2 changed files with 0 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/accounting/utils/next_uri.py
View File

@ -64,8 +64,6 @@ def __get_next_uri() -> str | None:
if request.method == "POST" else request.args.get("next")
if next_uri is None or not next_uri.startswith("/"):
return None
if len(next_uri) > 512:
return next_uri[:512]
return next_uri

15
tests/test_utils.py
View File

@ -140,21 +140,6 @@ class NextUriTestCase(unittest.TestCase):
"next": next_uri})
self.assertEqual(response.status_code, 200)
# An extremely-long URI to trigger the error
next_uri = "/" + "x" * 1024
expected2 = next_uri[:512]
expected1 = f"{self.TARGET}?next={quote_plus(expected2)}"
response = client.get(f"/test-invalid-next?next={quote_plus(next_uri)}"
f"&inherit-expected={quote_plus(expected1)}"
f"&or-expected={quote_plus(expected2)}")
self.assertEqual(response.status_code, 200)
response = client.post("/test-invalid-next"
f"?inherit-expected={quote_plus(expected1)}"
f"&or-expected={quote_plus(expected2)}",
data={"csrf_token": csrf_token,
"next": next_uri})
self.assertEqual(response.status_code, 200)
class QueryKeywordParserTestCase(unittest.TestCase):
"""The test case for the query keyword parser."""