mirror of
https://github.com/Hopiu/wagtail.git
synced 2026-04-14 03:50:59 +00:00
882f8f3cf8
After migrating a Wagtail-based site from MySQL to Postgres, we
noticed that malicious requests to the site that included percent-
encoded Unicode NULLs (`%00`) raised a `ValueError` exception that we
hadn't seen when using MySQL: `A string literal cannot contain NUL
(0x00) characters.` This appears to relate to `psycopg2`'s decision to
raise an exception in these situations, as discussed here:
https://github.com/psycopg/psycopg2/issues/420
While newer versions of Django appear to provide some field validation
that addresses these characters, it doesn't look like Wagtail's
redirect middleware is making use of those validators, and so it seemed
reasonable to clean these characters in the context of 'normalizing'
the paths before looking for corresponding redirects -- especially
since a quick investigation on the internet suggests that U+0000 in
URLs can be used as a means of attack, and also since RFC 3986 says:
Note, however, that the "%00" percent-encoding (NUL) may require
special handling and should be rejected if the application is not
expecting to receive raw data within a component.
|
||
|---|---|---|
| .. | ||
| _static | ||
| advanced_topics | ||
| contributing | ||
| editor_manual | ||
| getting_started | ||
| reference | ||
| releases | ||
| topics | ||
| autobuild.sh | ||
| conf.py | ||
| favicon.ico | ||
| index.rst | ||
| logo.png | ||
| Makefile | ||
| README.md | ||
| readthedocs.yml | ||
| requirements.txt | ||
| spelling_wordlist.txt | ||
| support.rst | ||
Wagtail docs
These are Sphinx docs, automatically built at http://docs.wagtail.io when the master branch is committed to Github. To build them locally, install Wagtail's development requirements (in the root Wagtail directory):
pip install -e .[testing,docs]
To build the documentation for browsing, from this directory run:
make html
then open _build/html/index.html in a browser.
To rebuild automatically while editing the documentation, from this directory run:
sphinx-autobuild . _build
The online editor at http://rst.ninjs.org/ is a helpful tool for checking reStructuredText syntax.