[Django] #32327: get_random_secret_key() should return a valid secret key
Django
-------------------------------------+-------------------------------------
Reporter: Sumanth | Owner: nobody
Ratna |
Type: | Status: new
Uncategorized |
Component: Core | Version: 3.1
(Management commands) |
Severity: Normal | Keywords:
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
-------------------------------------+-------------------------------------
[`check_secret_key()`](https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/checks/security/base.py#L192-L204)
may return a W009 warning if the output of
[`get_random_secret_key()`](https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/management/utils.py#L77-L82)
has less than 5 unique characters. The probability of this occurring is
extremely low (2.37595567e-25 if my math is correct), but this seems like
a safe check to have anyway.
The patch would be simple: wrap `get_random_secret_key()` in a do-while
(or a `while`, because Python) to ensure that the returned secret key is
secure.
--
Ticket URL: <https://code.djangoproject.com/ticket/32327>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
-------------------------------------+-------------------------------------
Type: Uncategorized | Status: new
Component: Core (Management | Version: 3.1
commands) |
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Sumanth Ratna):
(by the way, feel free to close since the probability that the described
issue occurs is practically 0)
--
Ticket URL: <https://code.djangoproject.com/ticket/32327#comment:1>
Django
-------------------------------------+-------------------------------------
Type: | Status: closed
Cleanup/optimization |
Component: Core (Management | Version: 3.1
commands) |
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
* status: new => closed
* type: Uncategorized => Cleanup/optimization
* resolution: => wontfix
Old description:
> [`check_secret_key()`](https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/checks/security/base.py#L192-L204)
> may return a W009 warning if the output of
> [`get_random_secret_key()`](https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/management/utils.py#L77-L82)
> has less than 5 unique characters. The probability of this occurring is
> extremely low (2.37595567e-25 if my math is correct), but this seems like
> a safe check to have anyway.
>
> The patch would be simple: wrap `get_random_secret_key()` in a do-while
> (or a `while`, because Python) to ensure that the returned secret key is
> secure.
New description:
[https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/checks/security/base.py#L192-L204
check_secret_key()] may return a W009 warning if the output of
[https://github.com/django/django/blob/6a054f768136de2caeaecf6c0fe9ffad76281373/django/core/management/utils.py#L77-L82
get_random_secret_key()] has less than 5 unique characters. The
probability of this occurring is extremely low (2.37595567e-25 if my math
is correct), but this seems like a safe check to have anyway.
The patch would be simple: wrap `get_random_secret_key()` in a do-while
(or a `while`, because Python) to ensure that the returned secret key is
secure.
--
Comment:
I don't think it's worth complexity, if someone will hit such secret they
should buy a lottery ticket and regenerate a secret key.
--
Ticket URL: <https://code.djangoproject.com/ticket/32327#comment:2>