Opened 70 minutes ago

Last modified 58 minutes ago

#37424 assigned Bug

CacheMiddleware does not correctly handle whitespace between "max-age" and the equals sign

Reported by: Jacob Walls Owned by: Jacob Walls
Component: Core (Cache system) Version: 6.1
Severity: Normal Keywords: not-security
Cc: Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: yes UI/UX: no

Description

Failing test:

  • tests/cache/tests.py 

    diff --git a/tests/cache/tests.py b/tests/cache/tests.py
index 96385fd084..3f7aec4961 100644
    a b class CacheUtils(SimpleTestCase):  
    23302330            ("no-cache,\tmax-age=600", 600),
    23312331            # Whitespace after the value is handled by int() transparently.
    23322332            ("max-age=300 ", 300),
     2333            # Whitespace preceding the =.
     2334            ("max-age =300", 300),
     2335            ("max-age\t=300 ", 300),
    23332336        ]
    23342337        for header_value, expected in tests:
    23352338            with self.subTest(header_value=header_value): 
AssertionError: None != 300

I believe we need changes analogous to patch_cache_control(), which calls strip() in _to_tuple(), see test_patch_cache_control_whitespace_around_equals():

        if len(t) > 1:
            return (t[0].strip().lower(), t[1])
        else:
            return (t[0].lower(), True)

Not a security issue, same class of public hardening as b461519bf5973d7fc149560d2f99acdba71a437d

Thanks Aaron Chen for the report.

Change History (1)

comment:1 by Jacob Walls, 58 minutes ago

Has patch: set

​PR

Note: See TracTickets for help on using tickets.
Back to Top