Changes between Initial Version and Version 1 of Ticket #21389, comment 3


Ignore:
Timestamp:
Nov 11, 2013, 6:16:40 AM (11 years ago)
Author:
Bouke Haarsma

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #21389, comment 3

    initial v1  
    55> Due to limitations imposed by Web server software on the size of HTTP header fields, combined with reasonable limits on the number of requests which may be handled by a single server process over its lifetime, this vulnerability may be difficult to exploit. Additionally, it is only present when the "USE_I18N" setting in Django is "True" and the i18n middleware component is enabled*. Nonetheless, all users of affected versions of Django are encouraged to update.
    66
     7Comparing the set of locales defined in `globalsettings.LANGUAGES` and Pythons' `locale_alias`, there are more locales suffering from this issue:
     8{{{
     9(
     10    ('fy-nl', 'Frisian'),
     11    ('ia', 'Interlingua'),
     12    ('kk', 'Kazakh'),
     13    ('lb', 'Luxembourgish'),
     14    ('mn', 'Mongolian'),
     15    ('my', 'Burmese'),
     16    ('ne', 'Nepali'),
     17    ('os', 'Ossetic'),
     18    ('sr-latn', 'Serbian Latin'),
     19    ('sw', 'Swahili'),
     20    ('udm', 'Udmurt'),
     21    ('zh-hans', 'Simplified Chinese'),
     22    ('zh-hant', 'Traditional Chinese'),
     23)
     24}}}
     25
     26HTTP Accept-Language follow the language tags defined by IANA and are defined as:
     27{{{
     28 langtag       = language
     29                 ["-" script]
     30                 ["-" region]
     31                 *("-" variant)
     32                 *("-" extension)
     33                 ["-" privateuse]
     34}}}
     35
     36According to IANA, there are 8068 languages, 162 scripts, 301 regions and 62 variants. Shipping an inclusive list of all possible language tags is probably overkill.
    737So there should be some limitation on which languages can be provided by the user to prevent such an attack, while allowing all possible languages and sublanguages.
Back to Top