Django 1.8.2 security release patches unusually dangerous bug

Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#1

Post by GlennCSmith » Wed, May 20, 2015, 6:28 PM UTC

Django 1.8.2 security release patches unusually dangerous bug – update ASAP
djangoproject.com

Re: Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#2

Post by GlennCSmith » Wed, May 20, 2015, 6:30 PM UTC

This is an unusually dangerous security bug. Definitely agree with the Django team that all users of Django 1.8 should upgrade as soon as possible.

Re: Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#3

Post by codygman » Wed, May 20, 2015, 7:25 PM UTC

Adding to my list of security vulnerabilities that static typing would have prevented.

Re: Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#4

Post by omouse » Wed, May 20, 2015, 9:09 PM UTC

still stuck on Django 1.6.x; also stuck with Python 2.7.x; fear is the order of the day when it comes to upgrades.

Re: Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#5

Post by jtokoph » Wed, May 20, 2015, 9:57 PM UTC

codygman wrote: post #3

Adding to my list of security vulnerabilities that static typing would have prevented.

Isn't an empty string still a string?

Re: Django 1.8.2 security release patches unusually dangerous bug – update ASAP

#6

Post by codygman » Wed, May 20, 2015, 10:13 PM UTC

jtokoph wrote: post #5

codygman wrote: post #3

Adding to my list of security vulnerabilities that static typing would have prevented.

Isn't an empty string still a string?

Right, the issue here is just using null or "". You could use an Optional or Maybe type here. Even better you could define:

    data SessionKey = ValidSessionKey | InvalidSessionKey

Then the developer making the modification code would have been much less likely to type "InvalidSessionKey" whereas the None/"" behavior is just an idiom. The problem here is that the domain knowledge of: "" is a valid session

wasn't communicated by the code.