kallithea Files · tox.ini

Files @ 38d1c99cd000

Branch filter:

Location: kallithea/tox.ini

38d1c99cd000 212 B text/x-ini Show Annotation Show as Raw Download as Raw

Søren Løvborg

login: enhance came_from validation

Drop urlparse and just validate that came_from is a RFC 3986 compliant path.

This blocks an HTTP header injection vulnerability discovered by
Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)

[tox]
minversion = 1.8
envlist = py{26,27}-{pytest,nose}

[testenv]
setenv =
    PYTHONHASHSEED = 0
deps =
    nose: nose
    pytest: pytest
commands =
    nose: nosetests {posargs}
    pytest: py.test {posargs}