Oneliner: re.sub('[^a-zA-Z0-9]', '', str(token.decode('ascii', 'ignore'))) if (len(token) == 32) else ''
Cheers, AT On Mon, Sep 12, 2011 at 5:32 PM, Carl Meyer <c...@oddbird.net> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Jens, > > On 09/12/2011 10:20 AM, Jens Diemer wrote: > > > > I wonder that the CSRF token send from the client didn't be validated. > > Well, it is sanitized to only alphanumeric characters, but you're right > that the length is never checked. > > > Don't know if a DOS attack is possible by sending many request with very > > long CSRF tokens? > > > > IMHO it's a good idea to check the length before do anything with it. > > Sanity-checking the length sounds reasonable to me - do you mind opening > a ticket for this and attaching your patch? > > Thanks, > > Carl > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iEYEARECAAYFAk5ubHQACgkQ8W4rlRKtE2frrQCgr8HhCPKaPGKyTocUGnmiU9Ku > ekYAoNgZqJ/n4SJnd1tD2Zkpeb/+du47 > =ZWv6 > -----END PGP SIGNATURE----- > > -- > You received this message because you are subscribed to the Google Groups > "Django developers" group. > To post to this group, send email to django-developers@googlegroups.com. > To unsubscribe from this group, send email to > django-developers+unsubscr...@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/django-developers?hl=en. > > -- You received this message because you are subscribed to the Google Groups "Django developers" group. To post to this group, send email to django-developers@googlegroups.com. To unsubscribe from this group, send email to django-developers+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/django-developers?hl=en.