harmacist/healthchecks
1
0
Fork 0
forked from GithubBackups/healthchecks
Code Issues Pull Requests Projects Releases Wiki Activity

For webhook integration, validate each header line separately

Browse Source
This commit is contained in:
Pēteris Caune 2019-12-27 13:56:33 +02:00
parent 057a6fe56b
commit be286518b7
No known key found for this signature in database
GPG Key ID: E28D7679E9A9EDE2
3 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file.
- Don't set CSRF cookie on first visit. Signup is exempt from CSRF protection - Don't set CSRF cookie on first visit. Signup is exempt from CSRF protection
- Fix List-Unsubscribe email header value: add angle brackets - Fix List-Unsubscribe email header value: add angle brackets
- Unsubscribe links serve a form, and require HTTP POST to actually unsubscribe - Unsubscribe links serve a form, and require HTTP POST to actually unsubscribe
- For webhook integration, validate each header line separately
## v1.11.0 - 2019-11-22 ## v1.11.0 - 2019-11-22

2
hc/front/forms.py
View File

@ -27,7 +27,7 @@ class HeadersField(forms.Field):
if not line.strip(): if not line.strip():
continue continue
if ":" not in value: if ":" not in line:
raise ValidationError(self.message) raise ValidationError(self.message)
n, v = line.split(":", maxsplit=1) n, v = line.split(":", maxsplit=1)

4
hc/front/tests/test_add_webhook.py
View File

@ -122,12 +122,12 @@ class AddWebhookTestCase(BaseTestCase):
form = { form = {
"method_down": "GET", "method_down": "GET",
"url_down": "http://example.org", "url_down": "http://example.org",
"headers_down": "invalid-headers", "headers_down": "invalid-header\nfoo:bar",
"method_up": "GET", "method_up": "GET",
} }
r = self.client.post(self.url, form) r = self.client.post(self.url, form)
self.assertContains(r, """invalid-headers""") self.assertContains(r, """invalid-header""")
self.assertEqual(Channel.objects.count(), 0) self.assertEqual(Channel.objects.count(), 0)
def test_it_strips_headers(self): def test_it_strips_headers(self):