Skip to content

Some urlpattern that refer to pks, now including .+ better written as \d+ #3776

Description

@gamboz

I'm reporting these because we have had a Chinese IP trying to SQL-inject one of our installations. There is no security issue AFAICT: one would just get a 500 (ValueError: invalid literal for int()...) instead of a 404 on such attempts.

src/transform/urls.py
10       re_path(r'^galley/(?P<galley_id>.+?)/generate-pdf/$', views.cassius_generate,
13       re_path(r'^galley/(?P<galley_id>.+?)/generate-epub/$', views.epub_generate,
                                         ^^^
src/journal/urls.py
64       re_path(r'^funder_articles/(?P<funder_id>.+)$', views.funder_articles, name='funder_articles'),
                                                  ^^

Metadata

Metadata

Assignees

Labels

bugSomething's not working

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions