search

qld-gov-au / ckanext-csrf-filter

A CKAN extension to add protection against Cross-Site Request Forgery attacks
GNU Affero General Public License v3.0
0 stars 6 forks source link

werkzeug response.data gives bytes, need str #16

Closed markstuart closed 2 years ago

markstuart commented 3 years ago

We are seeing an error when trying to load any page (after applying the fixes in #15) like this:

File "/ckan_repo_code/src/ckanext-csrf-filter/ckanext/csrf_filter/plugin.py", line 89, in set_csrf_token
anti_csrf.apply_token(response)
File "/ckan_repo_code/src/ckanext-csrf-filter/ckanext/csrf_filter/anti_csrf.py", line 375, in apply_token
html = insert_token(html, token)
File "/ckan_repo_code/src/ckanext-csrf-filter/ckanext/csrf_filter/anti_csrf.py", line 339, in insert_token
not POST_FORM.search(html) and not CONFIRM_MODULE.search(html)):
TypeError: cannot use a string pattern on a bytes-like object

It seems that the werkzeug response.data is a wrapper for get_data() and set_data(). get_data() can return str, but by default it returns bytes, and data uses get_datas default call.

See https://github.com/pallets/werkzeug/blob/dfde671ef969e27c7b14bd464688c009b34a7d2b/src/werkzeug/wrappers/base_response.py#L358

werkzeug 1.0.0 is what we end up with on CKAN 2.9.3 using the CKAN core requirements.txt file for Python 3