GHSA-gg2v-v5mp-jx42: 
Python Analyse et atténuation de la vulnérabilité

Impact

A Django model held in LiveView state, either on its own or inside a list, tuple, QuerySet or dict, reaches the native template engine as a mapping of everything the serializer collected for it: every model field that the global serialization floor and the model's own djust_exclude_fields / djust_serializable_fields settings allow, the result of each @property, and the result of each zero-argument get_*() method. Printing the model itself ({{ obj }}) wrote only its str(), but two filters wrote the whole mapping, and iteration and the mapping accessors (.items, .keys, .values, {% for k in obj %}) walked it:

• {{ rows|pprint }} wrote the mapping of every model in rows.
• {{ rows|json_script:"id" }} embedded the mapping of every model in rows in the page as JSON.
• {% for k, v in obj.items %} (and .keys, .values, iteration, |unordered_list) listed every collected value of obj. A template author who prints a container of models with one of these filters therefore published values the page never named: fields the author did not intend to show, and the computed results of properties and get_*() methods. Fields on the global floor (password, is_superuser, is_staff, DJUST_SENSITIVE_FIELDS) and fields a model lists in djust_exclude_fields were not included; the exposure is the remainder of the model's data. Exposure needs a template, written by the application author, that prints a model-holding container with pprint or json_script (or iterates a model). It does not let a visitor choose the template.

Affected versions

Measured on PyPI releases, with a model whose fields, a property and a get_*() method carried recognisable values, rendered through a LiveView template:

• 1.0.7, 1.0.12, 1.1.0 and 1.1.9: a QuerySet and a dict holding a model exposed the values through pprint and json_script; a list of models did not.
• 1.2.0, 1.2.1, 1.2.6 and 1.2.7: a list, a QuerySet and a dict holding a model exposed the values through both filters.
• 1.3.0rc4 (the earliest 1.3 release on PyPI), 1.3.0rc10, 1.3.0rc15 and 1.3.0rc16: a list and a QuerySet exposed the values through both filters; a dict holding a model did not on 1.3.0rc16. Releases before 1.0.7 were not measured.

Patches

Fixed in 1.2.8 and 1.3.0rc17. A model held in state or in a container is read by these sinks as its str(), the way Django prints a model, and is not a mapping: pprint and json_script write its text, the mapping accessors resolve to nothing, and iteration, |unordered_list, |safeseq and |escapeseq refuse it. A named read ({{ obj.name }}), {{ rows }}, |length and ordinary dicts are unchanged. A model whose str() is marked safe is recognised the same way and its text is escaped. A dict from application data that merely carries a __str__ key is still a dict. The fix is in the compiled extension, so the upgraded wheel is required.

Workarounds

Do not print a model-holding container with pprint or json_script: pass the template a list or dict of only the values the page needs, or print the named fields. Do not iterate .items of a model.

Credit

Found during the independent adversarial review of the fix for the lazily wrapped model gap.