validate CSRF token (Check length)

[jedie]

I wonder that the CSRF token send from the client didn't be validated.

Don't know if a DOS attack is possible by sending many request with very long CSRF tokens?

IMHO it's a good idea to check the length before do anything with it.

See also: ​https://groups.google.com/group/django-developers/browse_thread/thread/9fc008d2a3735bc2

[jedie]

Patch is here: ​https://github.com/django/django/pull/45

[Raúl Cumplido]

I will provide the tests to the pull request.

[Zbigniew Siciarz]

Provided test for the token length.

[Zbigniew Siciarz]

Replaced the magic number with a constant.

[Tomek Paczkowski]

Looks good.

[Ashutosh Dwivedi]

from the source code i noticed that the method

django.utils.crypto.constant_time_compare

is being used for comparing the request token from the one already present in the cookie, since the comparison is already constant time is the length checking really required ?

[Paul McMillan]

aashu_dwivedi: The length check is worth fixing. It is true that the constant_time_compare will fail early if the lengths do not match, but the performance concern is in the regex applied to sanitize the string before it gets to constant_time_compare.

In [17500]:

Fixes #16827. Adds a length check to CSRF tokens before applying the santizing regex. Thanks to jedie for the report and zsiciarz for the initial patch.