← All challenges
easydjango/django · v3.1

Settings are cleaned insufficiently.

webormbase d51c50d836
Mode

60 minutes, the full token budget.

  • Time limit60 min
  • Token budgetup to 1M
  • Worth up to135 XP

Opens VS Code with an AI agent in a new tab. Prompts, tokens, tool calls and test runs are recorded and scored.

Problem statement

Description

Posting publicly after checking with the rest of the security team.
I just ran into a case where django.views.debug.SafeExceptionReporterFilter.get_safe_settings() would return several un-cleansed values. Looking at cleanse_setting() I realized that we ​only take care of dicts but don't take other types of iterables into account but ​return them as-is.
Example:
In my settings.py I have this:
MY_SETTING = {
"foo": "value",
"secret": "value",
"token": "value",
"something": [
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
"else": [
[
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
[
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
]
}
On Django 3.0 and below:

>> import pprint
>> from django.views.debug import get_safe_settings
>> pprint.pprint(get_safe_settings()["MY_SETTING"])

{'else': [[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}]],
'foo': 'value',
'secret': '********************',
'something': [{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
'token': '********************'}
On Django 3.1 and up:

>> from django.views.debug import SafeExceptionReporterFilter
>> import pprint
>> pprint.pprint(SafeExceptionReporterFilter().get_safe_settings()["MY_SETTING"])

{'else': [[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}]],
'foo': 'value',
'secret': '********************',
'something': [{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
'token': '********************'}

The environment starts at commit d51c50d836c5 (django/django 3.1), dependencies installed and tests runnable from the first minute. You are graded by hidden tests taken from the fix that was actually merged upstream.