[Django] #26578: validate_ipv4_address (and probably other validators) accept non-ASCII digits
Django
digits
-------------------------------+--------------------
Reporter: mdickopp | Owner: nobody
Type: Bug | Status: new
Component: Uncategorized | Version: 1.9
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
validate_ipv4_address incorrectly accepts values that contain non-ASCII
digits, e.g. 127.0.0.൧ (where the last character is U+0D67) in Python 3.
This appears to be caused by the use of \d in the regular expression,
which matches not only ASCII digits [0-9], but any Unicode digit.
Other validators that use \d may be affected as well.
--
Ticket URL: <https://code.djangoproject.com/ticket/26578>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
digits
Reporter: mdickopp | Owner: nobody
Type: Bug | Status: new
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by claudep):
* needs_docs: => 0
* needs_better_patch: => 0
* component: Uncategorized => Core (Other)
* needs_tests: => 0
* stage: Unreviewed => Accepted
Comment:
See also #22378.
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:1>
Django
digits
Reporter: mdickopp | Owner: yakky
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Changes (by yakky):
* owner: nobody => yakky
* status: new => assigned
* cc: github@… (added)
Comment:
I'm willing to work on this. Following what has been done in #22378 fix is
replacing `\d` with `[0-9]+` in relevant validators
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:2>
Django
digits
Reporter: mdickopp | Owner: yakky
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Comment (by the-kid89):
I would suggest something a little more extensive for validating IP
addresses. This will get almost all invalid IP addresses. Though it does
still have problems with an IP address like "192.168.00.10".
"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$"
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:3>
Django
digits
Reporter: mdickopp | Owner: yakky
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Comment (by timgraham):
Well, actually we're trying to simplify the regular expressions we use at
least in some other places (e.g. #26423). Complex regular expressions are
difficult to maintain and have resulted in recursive backtracking security
issues.
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:4>
Django
digits
Reporter: mdickopp | Owner: yakky
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Comment (by the-kid89):
Replying to [comment:4 timgraham]:
> Well, actually we're trying to simplify the regular expressions we use
at least in some other places (e.g. #26423). Complex regular expressions
are difficult to maintain and have resulted in recursive backtracking
security issues.
If having a more complex but more accurate regex validation could cause a
security issue then its not worth it.
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:5>
Django
digits
Reporter: mdickopp | Owner: yakky
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Easy pickings: 0 | UI/UX: 0
Changes (by GreyZmeem):
* cc: greyzmeem@… (added)
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:6>
Django
digits
Reporter: Martin Dickopp | Owner: Iacopo
| Spalletti
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.9
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
Changes (by Tim Graham):
* needs_better_patch: 0 => 1
* has_patch: 0 => 1
Comment:
The [https://github.com/django/django/pull/7435 PR] could use a few more
tests.
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:7>
Django
digits
Reporter: Martin Dickopp | Owner: Iacopo
| Spalletti
Component: Core (Other) | Version: 1.9
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Changes (by Tim Graham <timograham@…>):
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"21dd792349ada4b68abf8fa3b50c0041438a89d9" 21dd7923]:
{{{
#!CommitTicketReference repository=""
revision="21dd792349ada4b68abf8fa3b50c0041438a89d9"
Fixed #26578 -- Prohibited non-ASCII digits in validate_ipv4_address.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/26578#comment:8>