Ticket #12544: 12544-handle-bogus-if-modified-since-r12117.diff

django/views/static.py

@@ -126 +126 @@
             raise ValueError
         matches = re.match(r"^([^;]+)(; length=([0-9]+))?$", header,
                            re.IGNORECASE)
-        header_mtime = mktime_tz(parsedate_tz(matches.group(1)))
+        try:
+            header_mtime = mktime_tz(parsedate_tz(matches.group(1)))
+        except OverflowError: # bogus timestamp
+            return False
         header_len = matches.group(3)
         if header_len and int(header_len) != size:
             raise ValueError

tests/regressiontests/views/tests/static.py

@@ -1 +1 @@
 from os import path
 
 from django.test import TestCase
+from django.http import HttpResponseNotModified
 from regressiontests.views.urls import media_dir
 
 class StaticTests(TestCase):
@@ -25 +26 @@
         file = open(path.join(media_dir, file_name))
         self.assertEquals(file.read(), response.content)
 
+    def test_is_modified_since(self):
+        file_name = 'file.txt'
+        response = self.client.get(
+            '/views/site_media/%s' % file_name,
+            HTTP_IF_MODIFIED_SINCE='Thu, 1 Jan 1970 00:00:00 GMT')
+        file = open(path.join(media_dir, file_name))
+        self.assertEquals(file.read(), response.content)
+
+    def test_not_modified_since(self):
+        file_name = 'file.txt'
+        response = self.client.get(
+            '/views/site_media/%s' % file_name,
+            HTTP_IF_MODIFIED_SINCE='Mon, 18 Jan 2038 05:14:07 UTC'
+            # This is 24h before max Unix time. Remember to fix Django and
+            # update this test well before 2038 :)
+            )
+        self.assertTrue(isinstance(response, HttpResponseNotModified))
+
+    def test_invalid_if_modified_since(self):
+        """Handle bogus If-Modified-Since values gracefully
+
+        To save resources, Django should reply with "not modified"
+        since we can assume these requests are not legitimate.
+        """
+        file_name = 'file.txt'
+        response = self.client.get(
+            '/views/site_media/%s' % file_name,
+            HTTP_IF_MODIFIED_SINCE='Fri, 34 Feb 3118 24:34:19 GMT'
+            # This is a real-life example of a bogus If-Modified-Since header.
+            )
+        self.assertTrue(isinstance(response, HttpResponseNotModified))