[Django] #37053: Add validate=True to base64.b64decode() calls

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah | Owner: Sarah Boyce
Boyce |
Type: | Status: assigned
Cleanup/optimization |
Component: Core | Version: dev
(Other) |
Severity: Normal | Keywords:
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
Following the recent Python CVE
https://www.cve.org/CVERecord?id=CVE-2026-3446, the security team agreed
there is no reason (to our knowledge) we shouldn't be using
`validate=True` in our `base64.b64decode()` calls.
--
Ticket URL: <https://code.djangoproject.com/ticket/37053>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------

Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce
Cleanup/optimization | Status: assigned
Component: Core (Other) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Sarah Boyce):

* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:1>

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce
Cleanup/optimization | Status: assigned
Component: Core (Other) | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* stage: Unreviewed => Accepted

Comment:

Thank you!
--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:2>

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce
Cleanup/optimization | Status: assigned
Component: Core (Other) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:3>

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce
Cleanup/optimization | Status: assigned
Component: Core (Other) | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Sarah Boyce):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:4>

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce
Cleanup/optimization | Status: assigned
Component: Core (Other) | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Ready for
| checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:5>

[Django]

#37053: Add validate=True to base64.b64decode() calls
-------------------------------------+-------------------------------------
Reporter: Sarah Boyce | Owner: Sarah
Type: | Boyce

Cleanup/optimization | Status: closed

Component: Core (Other) | Version: dev

Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls <jacobtylerwalls@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"57b23d15259c32dba80bb093645242f1b3b25365" 57b23d1]:
{{{#!CommitTicketReference repository=""
revision="57b23d15259c32dba80bb093645242f1b3b25365"
Fixed #37053 -- Added validate=True to base64.b64decode() calls.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/37053#comment:6>