Ticket #32578: 32578.diff

tests/csrf_tests/tests.py

@@ -317 +317 @@
         response = mw.process_view(req, token_view, (), {})
         self.assertEqual(response.status_code, 403)
 
+    def test_origin_malformed_host(self):
+        req = self._get_POST_no_csrf_cookie_request()
+        req._is_secure_override = True
+        req.META['HTTP_HOST'] = '@malformed'
+        req.META['HTTP_ORIGIN'] = 'https://www.evil.org'
+        req.META['SERVER_PORT'] = '443'
+        mw = CsrfViewMiddleware(token_view)
+        response = mw.process_view(req, token_view, (), {})
+        self.assertEqual(response.status_code, 403)
+
     @override_settings(DEBUG=True)
     def test_https_malformed_referer(self):
         """