Ticket #22804: 0001-Warn-on-unsafe-value-of-sep-in-Signer.patch

django/core/signing.py

@@ -38 +38 @@
 import base64
 import json
 import time
+import warnings
 import zlib
 
 from django.conf import settings
 from django.utils import baseconv
+from django.utils.deprecation import RemovedInNextVersionWarning
 from django.utils.crypto import constant_time_compare, salted_hmac
 from django.utils.encoding import force_bytes, force_str, force_text
 from django.utils.module_loading import import_string
 
+_SEP_UNSAFE = set(
+    "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+    "abcdefghijklmnopqrstuvwxyz-_="
+)
 
 class BadSignature(Exception):
     """
@@ -150 +156 @@
     def __init__(self, key=None, sep=':', salt=None):
         # Use of native strings in all versions of Python
         self.sep = force_str(sep)
+        sep_is_invalid = sep != ":" and (
+            not self.sep or
+            self.sep[0] in _SEP_UNSAFE or
+            self.sep[-1] in _SEP_UNSAFE
+        )
+        if sep_is_invalid:
+            warnings.warn(
+                "Unsafe Signer separator: %r (cannot be in %r)"
+                % (self.sep, "".join(_SEP_UNSAFE)),
+                RemovedInNextVersionWarning)
         self.key = key or settings.SECRET_KEY
         self.salt = force_str(salt or
             '%s.%s' % (self.__class__.__module__, self.__class__.__name__))

tests/signing/tests.py

@@ -1 +1 @@
 from __future__ import unicode_literals
 
 import time
+import warnings
 
 from django.core import signing
 from django.test import TestCase
@@ -111 +112 @@
         s = signing.Signer(binary_key)
         self.assertEqual('foo:6NB0fssLW5RQvZ3Y-MTerq2rX7w', s.sign('foo'))
 
+    def _test_invalid_sep(self, sep):
+        with warnings.catch_warnings(record=True) as recorded:
+            warnings.simplefilter('always')
+            signing.Signer(sep=sep)
+            self.assertEqual(len(recorded), 1)
+            msg = str(recorded[0].message)
+            self.assertTrue(msg.startswith("Unsafe Signer separator"))
+
+    def test_issues_warning_on_empty_invalid_sep(self):
+        self._test_invalid_sep("")
+
+    def test_issues_warning_on_single_chr_invalid_sep(self):
+        self._test_invalid_sep("-")
+
+    def test_issues_warning_on_multi_chr_invalid_sep(self):
+        self._test_invalid_sep("abc")
+
 
 class TestTimestampSigner(TestCase):