Re: Should Django use Ada?

[Jörg Breitbart]

You write:

"It could still be a vulnerability ... / It could fail to parse ... / 
could decide it's invalid - This is all pretty bad..."


I agree - this indeed would be really bad, if it can be used in 
malicious ways. But note that the fact that django or an upstream lib 
decided to slightly deviate from the latest URL parsing spec incarnation 
does not make it vulnerable per se. URL specs (or URI in general) used 
to contradict itself across various RFCs, so there is some ground of 
interpretation and which rules to follow in an implementation. Also 
django has to maintain backwards compat to some degree, and introducing 
a foreign c++ lib binding in its default installation is a very bold move.


Anything into this direction needs proper justification and not just 
handwaving arguments (FUD?), unless there actually is a real 
vulnerability with the current impl.


Cheers,
Jörg

--
You received this message because you are subscribed to the Google Groups "Django 
developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-developers/726fce28-2273-4672-8e00-f8619b95b0d9%40netzkolchose.de.

Re: Should Django use Ada?

[Dylan Reinhold]

I always wonder why people feel the need to belittle others' work with
statements like " But Python, being maintained mostly by volunteers, did
the minimum needed work to fix the vulnerability without really fixing the
urlparse library properly."
But then add something about their time being too valuable to work on
making it better.


Dylan


On Mon, Apr 1, 2024 at 1:37 PM 'Michael Lissner' via Django developers
(Contributions to Django itself)  wrote:

> Hi all,
>
> A few years ago, I reported a vulnerability in Django because Python
> wasn't parsing URLs containing tabs or newlines correctly. In this ticket,
> it was fixed in Python:
>
> https://bugs.python.org/issue43882
>
> But Python, being maintained mostly by volunteers, did the minimum needed
> work to fix the vulnerability without really fixing the urlparse library
> properly.
>
> This means that it's probably still possible to send a URL to django that
> urlparse doesn't know how to handle. When this happens:
>
> 1. It could still be a vulnerability.* If this is the case, Django could
> redirect people to domains where it shouldn't.
>
> 2. It could fail to parse the URL properly, leading to the wrong URL being
> provided to the user.
>
> 3. urlparse could decide it's an invalid URL even though it's not.
>
> This is all pretty bad, but there is some hope in the form of a tool
> called Ada, which aims to actually support URL parsing properly:
>
> Homepage: https://www.ada-url.com/
> Github (more useful, really): https://github.com/ada-url/ada
>
> It's written in C++, is used in Node and Cloudflare Workers. It has
> bindings for Python, Rust, R, and Go. It's licensed under MIT and Apache
> License 2.0. It's fuzzed by Google OSS Fuzzer, and it's much faster than
> urlparse.
>
> I'm curious: Would Django consider switching to this library? I'm not sure
> if I'll have time to do the work, but I can at least open an issue if it's
> a useful switch to make, and I might be able to assign a developer to it if
> this is something we want.
>
> Love to hear thoughts,
>
> Mike
>
>
> * I'm posting this publicly because this kind of vulnerability is really
> well known these days, and exists across most general-purpose languages.
> URLs are just very difficult to parse properly.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Django developers (Contributions to Django itself)" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to django-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/django-developers/f31bc17b-c0c5-4ce4--7d1ec3dfe90bn%40googlegroups.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-developers/CAHtg44DJfVrF4ZmUQLVaJyGTCcb%2BcQ4rJZr0%3DV39_f-PwVDTxg%40mail.gmail.com.

Should Django use Ada?

['Michael Lissner' via Django developers (Contributions to Django itself)]

Hi all, 

A few years ago, I reported a vulnerability in Django because Python wasn't 
parsing URLs containing tabs or newlines correctly. In this ticket, it was 
fixed in Python:

https://bugs.python.org/issue43882

But Python, being maintained mostly by volunteers, did the minimum needed 
work to fix the vulnerability without really fixing the urlparse library 
properly.

This means that it's probably still possible to send a URL to django that 
urlparse doesn't know how to handle. When this happens:

1. It could still be a vulnerability.* If this is the case, Django could 
redirect people to domains where it shouldn't.

2. It could fail to parse the URL properly, leading to the wrong URL being 
provided to the user.

3. urlparse could decide it's an invalid URL even though it's not.

This is all pretty bad, but there is some hope in the form of a tool called 
Ada, which aims to actually support URL parsing properly:

Homepage: https://www.ada-url.com/
Github (more useful, really): https://github.com/ada-url/ada

It's written in C++, is used in Node and Cloudflare Workers. It has 
bindings for Python, Rust, R, and Go. It's licensed under MIT and Apache 
License 2.0. It's fuzzed by Google OSS Fuzzer, and it's much faster than 
urlparse.

I'm curious: Would Django consider switching to this library? I'm not sure 
if I'll have time to do the work, but I can at least open an issue if it's 
a useful switch to make, and I might be able to assign a developer to it if 
this is something we want.

Love to hear thoughts,

Mike


* I'm posting this publicly because this kind of vulnerability is really 
well known these days, and exists across most general-purpose languages. 
URLs are just very difficult to parse properly.

-- 
You received this message because you are subscribed to the Google Groups 
"Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-developers/f31bc17b-c0c5-4ce4--7d1ec3dfe90bn%40googlegroups.com.

Re: Fellow Reports - March 2024

[Mariusz Felisiak]

March 25-26

*Triaged:*
https://code.djangoproject.com/ticket/35330 - The update of related 
objects fails in the admin when the related model is camel case. (accepted)
https://code.djangoproject.com/ticket/35331 - Adding a new related 
entry using the "+" sign from M2M field doesn't update lists. (accepted)
https://code.djangoproject.com/ticket/35332 - Bad performance in 
django.template.load.render_to_string (needsinfo)

*Reviewed/committed:*
https://github.com/django/django/pull/17981 - Fixed #35233 -- Moved 
template engine system checks to backend methods.

*Authored:*
https://github.com/django/djangoproject.com/pull/1494 - Retired myself.
https://github.com/django/django/pull/18015 - Increased test coverage 
for django.db.migrations.operations.special.
https://github.com/django/django/pull/18016 - Removed unused 
_alter_column_collation_sql() in PostgreSQL DatabaseSchemaEditor.
https://github.com/django/django/pull/18022 - Fixed #35329 -- Fixed 
migrations crash when adding partial unique constraints with nulls_distinct.
https://github.com/django/django/pull/18030 - Refs #35234 -- Skipped 
CheckConstraint system checks if not supported.

Best,
Mariusz

-- 
You received this message because you are subscribed to the Google Groups 
"Django developers  (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-developers/cba6f73b-38bf-40fc-92bb-a136b760eb3bn%40googlegroups.com.