django-careful-forms 0.1

Example

Consider the following example:

# models.py:

class SomeModel(models.Model):
    name = models.CharField(max_length=100)
    email = models.CharField(max_length=100)
    is_admin = models.BooleanField()


class SomeForm(ModelForm):
    class Meta:
        model = SomeModel

# template:

{{ form.name }}
{{ form.email }}

You might have noticed that the model form’s Meta class misses an exclude definition for the is_admin field (assuming this is a form that is going to be displayed to an end user).

Now on first glance this won’t cause any problems since the template only displays the name and email field. However by forgetting to exclude the is_admin field you are allowing users to change state internal to your application (and in this hypothetical example gain admin rights).

If we changed this example to use careful-forms instead the missing field would have triggerd a warning (or even an exception depending on settings, see below), alerting you to the vulnerability.

Motivation

The initial motivation for this package came from the recently well publicized ‘mass assignment’ vulnerability in the Rails framework. The specifics are not important but the basic problem was unchecked assignment of request data into a model.

Of course django is not susceptible to this particular problem because of its forms system. However even when using the forms system (especially when using Model Forms) it is still possible to inadvertently allow request data to be written to model fields that are supposed to be private (e.g. by forgetting to exclude internal fields).

The final trigger however was Erik Romijn’s nice talk Building secure Django websites at djangocon europe 2012 which explicitly mentions the forms pitfall in slide 53ff.

Compatibility

• Python 2.6+

• django 1.3+

Installation

The easy & recommended way:

#~ pip install django-careful-forms

Usage

1. Add "careful_forms.middleware.CarefulFormsMiddlware" to your projects settings.MIDDLEWARE_CLASSES. You should add it near the beginning of the list to make sure all forms are covered.

2. For every form that you want to be monitored by django-careful-forms change the base class of your forms to careful_forms.forms.CarefulModelForm (or CarefulForm for regular forms) [1].

Examples:

class MyForm(CarefulForm):
    # ...

class OtherForm(CarefulModelForm):
    # ...

class YetMoreForms(CarefulFormMixin, CustomFormBaseClass):
    # ...

Settings