<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Django 1.6.10 release notes — Django 1.11.20 documentation</title>
<link rel="stylesheet" href="../_static/default.css" type="text/css" />
<link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
<script type="text/javascript" id="documentation_options" data-url_root="../" src="../_static/documentation_options.js"></script>
<script type="text/javascript" src="../_static/jquery.js"></script>
<script type="text/javascript" src="../_static/underscore.js"></script>
<script type="text/javascript" src="../_static/doctools.js"></script>
<script type="text/javascript" src="../_static/language_data.js"></script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="Django 1.6.9 release notes" href="1.6.9.html" />
<link rel="prev" title="Django 1.6.11 release notes" href="1.6.11.html" />
<script type="text/javascript" src="../templatebuiltins.js"></script>
<script type="text/javascript">
(function($) {
if (!django_template_builtins) {
// templatebuiltins.js missing, do nothing.
return;
}
$(document).ready(function() {
// Hyperlink Django template tags and filters
var base = "../ref/templates/builtins.html";
if (base == "#") {
// Special case for builtins.html itself
base = "";
}
// Tags are keywords, class '.k'
$("div.highlight\\-html\\+django span.k").each(function(i, elem) {
var tagname = $(elem).text();
if ($.inArray(tagname, django_template_builtins.ttags) != -1) {
var fragment = tagname.replace(/_/, '-');
$(elem).html("<a href='" + base + "#" + fragment + "'>" + tagname + "</a>");
}
});
// Filters are functions, class '.nf'
$("div.highlight\\-html\\+django span.nf").each(function(i, elem) {
var filtername = $(elem).text();
if ($.inArray(filtername, django_template_builtins.tfilters) != -1) {
var fragment = filtername.replace(/_/, '-');
$(elem).html("<a href='" + base + "#" + fragment + "'>" + filtername + "</a>");
}
});
});
})(jQuery);
</script>
</head><body>
<div class="document">
<div id="custom-doc" class="yui-t6">
<div id="hd">
<h1><a href="../index.html">Django 1.11.20 documentation</a></h1>
<div id="global-nav">
<a title="Home page" href="../index.html">Home</a> |
<a title="Table of contents" href="../contents.html">Table of contents</a> |
<a title="Global index" href="../genindex.html">Index</a> |
<a title="Module index" href="../py-modindex.html">Modules</a>
</div>
<div class="nav">
« <a href="1.6.11.html" title="Django 1.6.11 release notes">previous</a>
|
<a href="index.html" title="Release notes" accesskey="U">up</a>
|
<a href="1.6.9.html" title="Django 1.6.9 release notes">next</a> »</div>
</div>
<div id="bd">
<div id="yui-main">
<div class="yui-b">
<div class="yui-g" id="releases-1.6.10">
<div class="section" id="s-django-1-6-10-release-notes">
<span id="django-1-6-10-release-notes"></span><h1>Django 1.6.10 release notes<a class="headerlink" href="#django-1-6-10-release-notes" title="Permalink to this headline">¶</a></h1>
<p><em>January 13, 2015</em></p>
<p>Django 1.6.10 fixes several security issues in 1.6.9.</p>
<div class="section" id="s-wsgi-header-spoofing-via-underscore-dash-conflation">
<span id="wsgi-header-spoofing-via-underscore-dash-conflation"></span><h2>WSGI header spoofing via underscore/dash conflation<a class="headerlink" href="#wsgi-header-spoofing-via-underscore-dash-conflation" title="Permalink to this headline">¶</a></h2>
<p>When HTTP headers are placed into the WSGI environ, they are normalized by
converting to uppercase, converting all dashes to underscores, and prepending
<cite>HTTP_</cite>. For instance, a header <code class="docutils literal notranslate"><span class="pre">X-Auth-User</span></code> would become
<code class="docutils literal notranslate"><span class="pre">HTTP_X_AUTH_USER</span></code> in the WSGI environ (and thus also in Django’s
<code class="docutils literal notranslate"><span class="pre">request.META</span></code> dictionary).</p>
<p>Unfortunately, this means that the WSGI environ cannot distinguish between
headers containing dashes and headers containing underscores: <code class="docutils literal notranslate"><span class="pre">X-Auth-User</span></code>
and <code class="docutils literal notranslate"><span class="pre">X-Auth_User</span></code> both become <code class="docutils literal notranslate"><span class="pre">HTTP_X_AUTH_USER</span></code>. This means that if a
header is used in a security-sensitive way (for instance, passing
authentication information along from a front-end proxy), even if the proxy
carefully strips any incoming value for <code class="docutils literal notranslate"><span class="pre">X-Auth-User</span></code>, an attacker may be
able to provide an <code class="docutils literal notranslate"><span class="pre">X-Auth_User</span></code> header (with underscore) and bypass this
protection.</p>
<p>In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers
containing underscores from incoming requests by default. Django’s built-in
development server now does the same. Django’s development server is not
recommended for production use, but matching the behavior of common production
servers reduces the surface area for behavior changes during deployment.</p>
</div>
<div class="section" id="s-mitigated-possible-xss-attack-via-user-supplied-redirect-urls">
<span id="mitigated-possible-xss-attack-via-user-supplied-redirect-urls"></span><h2>Mitigated possible XSS attack via user-supplied redirect URLs<a class="headerlink" href="#mitigated-possible-xss-attack-via-user-supplied-redirect-urls" title="Permalink to this headline">¶</a></h2>
<p>Django relies on user input in some cases (e.g.
<a class="reference internal" href="../topics/auth/default.html#django.contrib.auth.views.login" title="django.contrib.auth.views.login"><code class="xref py py-func docutils literal notranslate"><span class="pre">django.contrib.auth.views.login()</span></code></a> and <a class="reference internal" href="../topics/i18n/index.html"><span class="doc">i18n</span></a>)
to redirect the user to an “on success” URL. The security checks for these
redirects (namely <code class="docutils literal notranslate"><span class="pre">django.utils.http.is_safe_url()</span></code>) didn’t strip leading
whitespace on the tested URL and as such considered URLs like
<code class="docutils literal notranslate"><span class="pre">\njavascript:...</span></code> safe. If a developer relied on <code class="docutils literal notranslate"><span class="pre">is_safe_url()</span></code> to
provide safe redirect targets and put such a URL into a link, they could suffer
from a XSS attack. This bug doesn’t affect Django currently, since we only put
this URL into the <code class="docutils literal notranslate"><span class="pre">Location</span></code> response header and browsers seem to ignore
JavaScript there.</p>
</div>
<div class="section" id="s-denial-of-service-attack-against-django-views-static-serve">
<span id="denial-of-service-attack-against-django-views-static-serve"></span><h2>Denial-of-service attack against <code class="docutils literal notranslate"><span class="pre">django.views.static.serve</span></code><a class="headerlink" href="#denial-of-service-attack-against-django-views-static-serve" title="Permalink to this headline">¶</a></h2>
<p>In older versions of Django, the <a class="reference internal" href="../ref/views.html#django.views.static.serve" title="django.views.static.serve"><code class="xref py py-func docutils literal notranslate"><span class="pre">django.views.static.serve()</span></code></a> view read
the files it served one line at a time. Therefore, a big file with no newlines
would result in memory usage equal to the size of that file. An attacker could
exploit this and launch a denial-of-service attack by simultaneously requesting
many large files. This view now reads the file in chunks to prevent large
memory usage.</p>
<p>Note, however, that this view has always carried a warning that it is not
hardened for production use and should be used only as a development aid. Now
may be a good time to audit your project and serve your files in production
using a real front-end web server if you are not doing so.</p>
</div>
<div class="section" id="s-database-denial-of-service-with-modelmultiplechoicefield">
<span id="database-denial-of-service-with-modelmultiplechoicefield"></span><h2>Database denial-of-service with <code class="docutils literal notranslate"><span class="pre">ModelMultipleChoiceField</span></code><a class="headerlink" href="#database-denial-of-service-with-modelmultiplechoicefield" title="Permalink to this headline">¶</a></h2>
<p>Given a form that uses <code class="docutils literal notranslate"><span class="pre">ModelMultipleChoiceField</span></code> and
<code class="docutils literal notranslate"><span class="pre">show_hidden_initial=True</span></code> (not a documented API), it was possible for a user
to cause an unreasonable number of SQL queries by submitting duplicate values
for the field’s data. The validation logic in <code class="docutils literal notranslate"><span class="pre">ModelMultipleChoiceField</span></code> now
deduplicates submitted values to address this issue.</p>
</div>
</div>
</div>
</div>
</div>
<div class="yui-b" id="sidebar">
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<h3><a href="../contents.html">Table of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">Django 1.6.10 release notes</a><ul>
<li><a class="reference internal" href="#wsgi-header-spoofing-via-underscore-dash-conflation">WSGI header spoofing via underscore/dash conflation</a></li>
<li><a class="reference internal" href="#mitigated-possible-xss-attack-via-user-supplied-redirect-urls">Mitigated possible XSS attack via user-supplied redirect URLs</a></li>
<li><a class="reference internal" href="#denial-of-service-attack-against-django-views-static-serve">Denial-of-service attack against <code class="docutils literal notranslate"><span class="pre">django.views.static.serve</span></code></a></li>
<li><a class="reference internal" href="#database-denial-of-service-with-modelmultiplechoicefield">Database denial-of-service with <code class="docutils literal notranslate"><span class="pre">ModelMultipleChoiceField</span></code></a></li>
</ul>
</li>
</ul>
<h4>Previous topic</h4>
<p class="topless"><a href="1.6.11.html"
title="previous chapter">Django 1.6.11 release notes</a></p>
<h4>Next topic</h4>
<p class="topless"><a href="1.6.9.html"
title="next chapter">Django 1.6.9 release notes</a></p>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../_sources/releases/1.6.10.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<h3>Last update:</h3>
<p class="topless">Feb 11, 2019</p>
</div>
</div>
<div id="ft">
<div class="nav">
« <a href="1.6.11.html" title="Django 1.6.11 release notes">previous</a>
|
<a href="index.html" title="Release notes" accesskey="U">up</a>
|
<a href="1.6.9.html" title="Django 1.6.9 release notes">next</a> »</div>
</div>
</div>
<div class="clearer"></div>
</div>
</body>
</html>
