python-Flask-Cors/CVE-2024-1681.patch
starlet-dx ef2eb684a4 Fix CVE-2024-1681
(cherry picked from commit 9c2bd2fd623ad4794bb5c103ffb99cd3c9e3bdd7)
2024-05-28 15:34:02 +08:00

25 lines
1.1 KiB
Diff

From 6172c2000dba965fedb8e9a8a916ad56f0fb2630 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anes=20Hujevi=C4=87?= <anes1996_h@hotmail.com>
Date: Sat, 4 May 2024 21:28:47 +0200
Subject: [PATCH] Update extension.py to clean request.path before logging it
(#351)
* Update extension.py to use string format specifier for cleaning request.path
---
flask_cors/extension.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flask_cors/extension.py b/flask_cors/extension.py
index 6f76995..6361dcc 100644
--- a/flask_cors/extension.py
+++ b/flask_cors/extension.py
@@ -193,7 +193,7 @@ def cors_after_request(resp):
normalized_path = unquote_plus(request.path)
for res_regex, res_options in resources:
if try_match(normalized_path, res_regex):
- LOG.debug("Request to '%s' matches CORS resource '%s'. Using options: %s",
+ LOG.debug("Request to '%r' matches CORS resource '%s'. Using options: %s",
request.path, get_regexp_pattern(res_regex), res_options)
set_cors_headers(resp, res_options)
break