Mercurial > kallithea
view tox.ini @ 5523:38d1c99cd000 stable
login: enhance came_from validation
Drop urlparse and just validate that came_from is a RFC 3986 compliant path.
This blocks an HTTP header injection vulnerability discovered by
Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)
author | Søren Løvborg <sorenl@unity3d.com> |
---|---|
date | Wed, 23 Sep 2015 16:09:14 +0200 |
parents | 768989c595aa |
children | 6a83b399bb3c |
line wrap: on
line source
[tox] minversion = 1.8 envlist = py{26,27}-{pytest,nose} [testenv] setenv = PYTHONHASHSEED = 0 deps = nose: nose pytest: pytest commands = nose: nosetests {posargs} pytest: py.test {posargs}