[Django] #36470: Potential log injection in development server (runserver) logging

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Type:
| Cleanup/optimization
Status: new | Component: Core
| (Management commands)
Version: dev | Severity: Normal
Keywords: runserver | Triage Stage:
log_message | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
`django.core.servers.basehttp.WSGIRequestHandler.log_response()` may emit
log records that are not properly escaped or sanitized, making it possible
for specially crafted requests to inject terminal escape sequences or
misleading log content. This only affects the internal development server
(`runserver` command). Per the documentation, this server is not intended
for production use and has not been security-audited.

Although this is not considered a vulnerability, a fix for defense-in-
depth should be applied, also to avoid confusion and future security
reports about the same thing. This fix would be in line to what
[https://github.com/python/cpython/blob/1c7efaf58a62d848421b2da97360ba3df7d7856b/Lib/http/server.py#L626
Python does for esacaping].

Thanks to "Kainan Zhang (@4xpl0r3r) from Fortinet" for the report in the
security mailing list.
--
Ticket URL: <https://code.djangoproject.com/ticket/36470>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------

Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by David Sanders):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:1>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jake Howard):

* cc: Jake Howard (added)

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:2>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

I think that an ideal solution would be to use
`django.utils.log.log_response()` to implemenet
`django.core.servers.basehttp.WSGIRequestHandler.log_message()`.
--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:3>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner: (none)
Type: | Status: new
Cleanup/optimization |
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Description changed by Natalia Bidart:

Old description:

> `django.core.servers.basehttp.WSGIRequestHandler.log_response()` may emit
> log records that are not properly escaped or sanitized, making it
> possible for specially crafted requests to inject terminal escape
> sequences or misleading log content. This only affects the internal
> development server (`runserver` command). Per the documentation, this
> server is not intended for production use and has not been security-
> audited.
>
> Although this is not considered a vulnerability, a fix for defense-in-
> depth should be applied, also to avoid confusion and future security
> reports about the same thing. This fix would be in line to what
> [https://github.com/python/cpython/blob/1c7efaf58a62d848421b2da97360ba3df7d7856b/Lib/http/server.py#L626
> Python does for esacaping].
>
> Thanks to "Kainan Zhang (@4xpl0r3r) from Fortinet" for the report in the
> security mailing list.

New description:

`django.core.servers.basehttp.WSGIRequestHandler.log_message()` may emit

log records that are not properly escaped or sanitized, making it possible
for specially crafted requests to inject terminal escape sequences or
misleading log content. This only affects the internal development server
(`runserver` command). Per the documentation, this server is not intended
for production use and has not been security-audited.

Although this is not considered a vulnerability, a fix for defense-in-
depth should be applied, also to avoid confusion and future security
reports about the same thing. This fix would be in line to what
[https://github.com/python/cpython/blob/1c7efaf58a62d848421b2da97360ba3df7d7856b/Lib/http/server.py#L626
Python does for esacaping].

Thanks to "Kainan Zhang (@4xpl0r3r) from Fortinet" for the report in the
security mailing list.

--

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:4>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner:

Type: | YashRaj1506
Cleanup/optimization | Status: assigned

Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by YashRaj1506):

* owner: (none) => YashRaj1506
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:5>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner:
Type: | YashRaj1506
Cleanup/optimization | Status: assigned
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by houston0222):

* has_patch: 0 => 1

Comment:

Submitted a PR to address this issue:
https://github.com/django/django/pull/19592

This patch strips ANSI escape codes from log_message() arguments in the
development server to prevent terminal log injection.
It includes a regression test to verify the behavior.
--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:6>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner:
Type: | YashRaj1506
Cleanup/optimization | Status: assigned
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:7>

[Django]

#36470: Potential log injection in development server (runserver) logging
-------------------------------------+-------------------------------------
Reporter: Natalia Bidart | Owner:
Type: | YashRaj1506
Cleanup/optimization | Status: assigned
Component: Core (Management | Version: dev
commands) |
Severity: Normal | Resolution:
Keywords: runserver | Triage Stage: Accepted
log_message |
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by YashRaj1506):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/36470#comment:8>