encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-10-31 16:07:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

Handle invalid characters in headers

Browse Source
This commit is contained in:
Osvaldo Santana Neto 2015-06-03 14:55:34 -03:00
parent 0c66c7cfa6
commit 7ae71deb84
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
rest_framework/authentication.py
View File

@ -170,7 +170,13 @@ class TokenAuthentication(BaseAuthentication):
msg = _('Invalid token header. Token string should not contain spaces.') msg = _('Invalid token header. Token string should not contain spaces.')
raise exceptions.AuthenticationFailed(msg) raise exceptions.AuthenticationFailed(msg)
return self.authenticate_credentials(auth[1]) try:
token = auth[1].decode()
except UnicodeError:
msg = _('Invalid token header. Token string should not contain invalid characters.')
raise exceptions.AuthenticationFailed(msg)
return self.authenticate_credentials(token)
def authenticate_credentials(self, key): def authenticate_credentials(self, key):
try: try:

8
tests/test_authentication.py
View File

@ -1,3 +1,5 @@
# coding: utf-8
from __future__ import unicode_literals from __future__ import unicode_literals
from django.conf.urls import patterns, url, include from django.conf.urls import patterns, url, include
from django.contrib.auth.models import User from django.contrib.auth.models import User
@ -162,6 +164,12 @@ class TokenAuthTests(TestCase):
response = self.csrf_client.post('/token/', {'example': 'example'}, HTTP_AUTHORIZATION=auth) response = self.csrf_client.post('/token/', {'example': 'example'}, HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_200_OK) self.assertEqual(response.status_code, status.HTTP_200_OK)
def test_fail_post_form_passing_invalid_token_auth(self):
# add an 'invalid' unicode character
auth = 'Token ' + self.key + "¸"
response = self.csrf_client.post('/token/', {'example': 'example'}, HTTP_AUTHORIZATION=auth)
self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
def test_post_json_passing_token_auth(self): def test_post_json_passing_token_auth(self):
"""Ensure POSTing form over token auth with correct credentials passes and does not require CSRF""" """Ensure POSTing form over token auth with correct credentials passes and does not require CSRF"""
auth = "Token " + self.key auth = "Token " + self.key