-
-
Notifications
You must be signed in to change notification settings - Fork 32.7k
Fixed #36470 -- Potential log injection in development server (runserver) logging #19593
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
@nessita I have followed the approach you suggested, i used the logic from log_response() for escaping part. Does this look good to you? I ran the tests and it worked. Would love to know your opinion over this. |
It looks quite good, thank you! I was wondering if we could fully reuse |
Thank you! and about reusing the What are your opinions on this @nessita ? |
@nessita i just wanted to know more of your opinions on this pr, if there is something i should look into? or the changes are satisfactory? |
@YashRaj1506 pls stop pinging people directly, the reviewers have this on their list of things to look at and it's unnecessary to burden them with further notifications 👍 |
@shangxiao Totally! I get it! |
Fixed #36470 -- Potential log injection in development server (runserver) logging
Trac ticket number
ticket-36470
Branch description
Fixed a log injection issue in Django's development server by escaping all control characters in user inputs passed to log_message(), and verified this behavior through tests.
Checklist
main
branch.