Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reject NUL byte in URLs #1280

Merged
merged 1 commit into from
Nov 3, 2023
Merged

Reject NUL byte in URLs #1280

merged 1 commit into from
Nov 3, 2023

Conversation

chris34
Copy link
Member

@chris34 chris34 commented Nov 3, 2023

Sentry reported f.e. for the URL
http://ubuntuusers.de/calendar/2014/03/11/ubuntu-developer-summit-14-1%00%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%2527%2522/ics/ the traceback

ValueError: A string literal cannot contain NUL (0x00) characters.
  File "django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "django/core/handlers/base.py", line 181, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "inyoka/portal/views.py", line 1464, in calendar_ical
    event = Event.objects.get(slug=slug)
  File "django/db/models/manager.py", line 85, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
  File "django/db/models/query.py", line 431, in get
    num = len(clone)
  File "django/db/models/query.py", line 262, in __len__
    self._fetch_all()
  File "django/db/models/query.py", line 1324, in _fetch_all
    self._result_cache = list(self._iterable_class(self))
  File "django/db/models/query.py", line 51, in __iter__
    results = compiler.execute_sql(chunked_fetch=self.chunked_fetch, chunk_size=self.chunk_size)
  File "django/db/models/sql/compiler.py", line 1175, in execute_sql
    cursor.execute(sql, params)
  File "django/db/backends/utils.py", line 66, in execute
    return self._execute_with_wrappers(sql, params, many=False, executor=self._execute)
  File "django/db/backends/utils.py", line 75, in _execute_with_wrappers
    return executor(sql, params, many, context)
  File "django/db/backends/utils.py", line 84, in _execute
    return self.cursor.execute(sql, params)

Sentry reported f.e. for the URL
`http://ubuntuusers.de/calendar/2014/03/11/ubuntu-developer-summit-14-1%00%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%2527%2522/ics/`
the traceback

```
ValueError: A string literal cannot contain NUL (0x00) characters.
  File "django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "django/core/handlers/base.py", line 181, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "inyoka/portal/views.py", line 1464, in calendar_ical
    event = Event.objects.get(slug=slug)
  File "django/db/models/manager.py", line 85, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
  File "django/db/models/query.py", line 431, in get
    num = len(clone)
  File "django/db/models/query.py", line 262, in __len__
    self._fetch_all()
  File "django/db/models/query.py", line 1324, in _fetch_all
    self._result_cache = list(self._iterable_class(self))
  File "django/db/models/query.py", line 51, in __iter__
    results = compiler.execute_sql(chunked_fetch=self.chunked_fetch, chunk_size=self.chunk_size)
  File "django/db/models/sql/compiler.py", line 1175, in execute_sql
    cursor.execute(sql, params)
  File "django/db/backends/utils.py", line 66, in execute
    return self._execute_with_wrappers(sql, params, many=False, executor=self._execute)
  File "django/db/backends/utils.py", line 75, in _execute_with_wrappers
    return executor(sql, params, many, context)
  File "django/db/backends/utils.py", line 84, in _execute
    return self.cursor.execute(sql, params)
```
@chris34 chris34 merged commit 3e736cb into staging Nov 3, 2023
4 checks passed
@chris34 chris34 deleted the null-byte branch November 3, 2023 23:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant