Ticket #20128: 20128.patch

django/middleware/csrf.py

@@ -171 +171 @@
             # Check non-cookie token for match.
             request_csrf_token = ""
             if request.method == "POST":
-                request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
+                try:
+                    request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
+                except IOError:
+                    # Sometimes we get IOErrors due to a broken connection
+                    # before we've completed reading the POST data. Process
+                    # view middleware may not raise any exceptions, so we'll
+                    # ignore and go on to serve the user a 403 (assuming he's
+                    # still listening... which he probably isn't because of
+                    # the IOError).
+                    request_csrf_token = ""
 
             if request_csrf_token == "":
                 # Fall back to X-CSRFToken, to make things easier for AJAX,

tests/csrf_tests/tests.py

@@ -46 +46 @@
     def is_secure(self):
         return getattr(self, '_is_secure_override', False)
 
+class BrokenHttpCsrfPostRequest(HttpRequest):
+    """
+    HttpRequest that can fail when accessing POST data
+    """
+    def __init__(self, token, is_broken):
+        super(BrokenHttpCsrfPostRequest, self).__init__()
+        self.method = 'POST'
+
+        self.is_broken = False
+        self.COOKIES[settings.CSRF_COOKIE_NAME] = token
+        self.POST['csrfmiddlewaretoken'] = token
+        self.is_broken = is_broken
+
+    def _load_post_and_files(self):
+        raise IOError('error reading input data')
+
+    def _get_post(self):
+        if self.is_broken:
+            # Break!
+            self._load_post_and_files()
+        assert hasattr(self, '_post')
+        return self._post
+
+    def _set_post(self, post):
+        self._post = post
+
+    POST = property(_get_post, _set_post)
+
 class CsrfViewMiddlewareTest(TestCase):
     # The csrf token is potentially from an untrusted source, so could have
     # characters that need dealing with.
@@ -340 +368 @@
         resp2 = CsrfViewMiddleware().process_response(req, resp)
         self.assertTrue(resp2.cookies.get(settings.CSRF_COOKIE_NAME, False))
         self.assertTrue('Cookie' in resp2.get('Vary',''))
+
+    def test_postdata_failure(self):
+        """
+        Tests that IOErrors during POST data reading are caught and
+        treated as if the POST data wasn't there.
+        """
+        token = 'ABC'
+
+        # The is_broken flag is used as a self-test for the test.
+        req = BrokenHttpCsrfPostRequest(token, is_broken=False)
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertEqual(req2, None)
+
+        req = BrokenHttpCsrfPostRequest(token, is_broken=True)
+        req2 = CsrfViewMiddleware().process_view(req, post_form_view, (), {})
+        self.assertEqual(req2.status_code, 403)