测试gitnore

venv/Lib/site-packages/django/middleware/cache.py

@@ -46,10 +46,7 @@ More details about how the caching works:
 from django.conf import settings
 from django.core.cache import DEFAULT_CACHE_ALIAS, caches
 from django.utils.cache import (
-    get_cache_key,
-    get_max_age,
-    has_vary_header,
-    learn_cache_key,
+    get_cache_key, get_max_age, has_vary_header, learn_cache_key,
     patch_response_headers,
 )
 from django.utils.deprecation import MiddlewareMixin
@@ -64,8 +61,9 @@ class UpdateCacheMiddleware(MiddlewareMixin):
     UpdateCacheMiddleware must be the first piece of middleware in MIDDLEWARE
     so that it'll get called last during the response phase.
     """
-
-    def __init__(self, get_response):
+    # RemovedInDjango40Warning: when the deprecation ends, replace with:
+    #   def __init__(self, get_response):
+    def __init__(self, get_response=None):
         super().__init__(get_response)
         self.cache_timeout = settings.CACHE_MIDDLEWARE_SECONDS
         self.page_timeout = None
@@ -74,7 +72,7 @@ class UpdateCacheMiddleware(MiddlewareMixin):
         self.cache = caches[self.cache_alias]
 
     def _should_update_cache(self, request, response):
-        return hasattr(request, "_cache_update_cache") and request._cache_update_cache
+        return hasattr(request, '_cache_update_cache') and request._cache_update_cache
 
     def process_response(self, request, response):
         """Set the cache, if needed."""
@@ -87,15 +85,11 @@ class UpdateCacheMiddleware(MiddlewareMixin):
 
         # Don't cache responses that set a user-specific (and maybe security
         # sensitive) cookie in response to a cookie-less request.
-        if (
-            not request.COOKIES
-            and response.cookies
-            and has_vary_header(response, "Cookie")
-        ):
+        if not request.COOKIES and response.cookies and has_vary_header(response, 'Cookie'):
             return response
 
         # Don't cache a response with 'Cache-Control: private'
-        if "private" in response.get("Cache-Control", ()):
+        if 'private' in response.get('Cache-Control', ()):
             return response
 
         # Page timeout takes precedence over the "max-age" and the default
@@ -112,10 +106,8 @@ class UpdateCacheMiddleware(MiddlewareMixin):
                 return response
         patch_response_headers(response, timeout)
         if timeout and response.status_code == 200:
-            cache_key = learn_cache_key(
-                request, response, timeout, self.key_prefix, cache=self.cache
-            )
-            if hasattr(response, "render") and callable(response.render):
+            cache_key = learn_cache_key(request, response, timeout, self.key_prefix, cache=self.cache)
+            if hasattr(response, 'render') and callable(response.render):
                 response.add_post_render_callback(
                     lambda r: self.cache.set(cache_key, r, timeout)
                 )
@@ -132,8 +124,9 @@ class FetchFromCacheMiddleware(MiddlewareMixin):
     FetchFromCacheMiddleware must be the last piece of middleware in MIDDLEWARE
     so that it'll get called last during the request phase.
     """
-
-    def __init__(self, get_response):
+    # RemovedInDjango40Warning: when the deprecation ends, replace with:
+    #   def __init__(self, get_response):
+    def __init__(self, get_response=None):
         super().__init__(get_response)
         self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
         self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS
@@ -144,21 +137,19 @@ class FetchFromCacheMiddleware(MiddlewareMixin):
         Check whether the page is already cached and return the cached
         version if available.
         """
-        if request.method not in ("GET", "HEAD"):
+        if request.method not in ('GET', 'HEAD'):
             request._cache_update_cache = False
             return None  # Don't bother checking the cache.
 
         # try and get the cached GET response
-        cache_key = get_cache_key(request, self.key_prefix, "GET", cache=self.cache)
+        cache_key = get_cache_key(request, self.key_prefix, 'GET', cache=self.cache)
         if cache_key is None:
             request._cache_update_cache = True
             return None  # No cache information available, need to rebuild.
         response = self.cache.get(cache_key)
         # if it wasn't found and we are looking for a HEAD, try looking just for that
-        if response is None and request.method == "HEAD":
-            cache_key = get_cache_key(
-                request, self.key_prefix, "HEAD", cache=self.cache
-            )
+        if response is None and request.method == 'HEAD':
+            cache_key = get_cache_key(request, self.key_prefix, 'HEAD', cache=self.cache)
             response = self.cache.get(cache_key)
 
         if response is None:
@@ -177,8 +168,9 @@ class CacheMiddleware(UpdateCacheMiddleware, FetchFromCacheMiddleware):
     Also used as the hook point for the cache decorator, which is generated
     using the decorator-from-middleware utility.
     """
-
-    def __init__(self, get_response, cache_timeout=None, page_timeout=None, **kwargs):
+    # RemovedInDjango40Warning: when the deprecation ends, replace with:
+    #   def __init__(self, get_response, cache_timeout=None, page_timeout=None, **kwargs):
+    def __init__(self, get_response=None, cache_timeout=None, page_timeout=None, **kwargs):
         super().__init__(get_response)
         # We need to differentiate between "provided, but using default value",
         # and "not provided". If the value is provided using a default, then
@@ -186,14 +178,14 @@ class CacheMiddleware(UpdateCacheMiddleware, FetchFromCacheMiddleware):
         # we need to use middleware defaults.
 
         try:
-            key_prefix = kwargs["key_prefix"]
+            key_prefix = kwargs['key_prefix']
             if key_prefix is None:
-                key_prefix = ""
+                key_prefix = ''
             self.key_prefix = key_prefix
         except KeyError:
             pass
         try:
-            cache_alias = kwargs["cache_alias"]
+            cache_alias = kwargs['cache_alias']
             if cache_alias is None:
                 cache_alias = DEFAULT_CACHE_ALIAS
             self.cache_alias = cache_alias

venv/Lib/site-packages/django/middleware/clickjacking.py

@@ -21,17 +21,16 @@ class XFrameOptionsMiddleware(MiddlewareMixin):
     response from being loaded in a frame in any site, set X_FRAME_OPTIONS in
     your project's Django settings to 'DENY'.
     """
-
     def process_response(self, request, response):
         # Don't set it if it's already in the response
-        if response.get("X-Frame-Options") is not None:
+        if response.get('X-Frame-Options') is not None:
             return response
 
         # Don't set it if they used @xframe_options_exempt
-        if getattr(response, "xframe_options_exempt", False):
+        if getattr(response, 'xframe_options_exempt', False):
             return response
 
-        response.headers["X-Frame-Options"] = self.get_xframe_options_value(
+        response.headers['X-Frame-Options'] = self.get_xframe_options_value(
             request,
             response,
         )
@@ -45,4 +44,4 @@ class XFrameOptionsMiddleware(MiddlewareMixin):
         This method can be overridden if needed, allowing it to vary based on
         the request or response.
         """
-        return getattr(settings, "X_FRAME_OPTIONS", "DENY").upper()
+        return getattr(settings, 'X_FRAME_OPTIONS', 'DENY').upper()

venv/Lib/site-packages/django/middleware/common.py

@@ -38,16 +38,16 @@ class CommonMiddleware(MiddlewareMixin):
         """
 
         # Check for denied User-Agents
-        user_agent = request.META.get("HTTP_USER_AGENT")
+        user_agent = request.META.get('HTTP_USER_AGENT')
         if user_agent is not None:
             for user_agent_regex in settings.DISALLOWED_USER_AGENTS:
                 if user_agent_regex.search(user_agent):
-                    raise PermissionDenied("Forbidden user agent")
+                    raise PermissionDenied('Forbidden user agent')
 
         # Check for a redirect based on settings.PREPEND_WWW
         host = request.get_host()
-        must_prepend = settings.PREPEND_WWW and host and not host.startswith("www.")
-        redirect_url = ("%s://www.%s" % (request.scheme, host)) if must_prepend else ""
+        must_prepend = settings.PREPEND_WWW and host and not host.startswith('www.')
+        redirect_url = ('%s://www.%s' % (request.scheme, host)) if must_prepend else ''
 
         # Check if a slash should be appended
         if self.should_redirect_with_slash(request):
@@ -65,13 +65,13 @@ class CommonMiddleware(MiddlewareMixin):
         Return True if settings.APPEND_SLASH is True and appending a slash to
         the request path turns an invalid path into a valid one.
         """
-        if settings.APPEND_SLASH and not request.path_info.endswith("/"):
-            urlconf = getattr(request, "urlconf", None)
+        if settings.APPEND_SLASH and not request.path_info.endswith('/'):
+            urlconf = getattr(request, 'urlconf', None)
             if not is_valid_path(request.path_info, urlconf):
-                match = is_valid_path("%s/" % request.path_info, urlconf)
+                match = is_valid_path('%s/' % request.path_info, urlconf)
                 if match:
                     view = match.func
-                    return getattr(view, "should_append_slash", True)
+                    return getattr(view, 'should_append_slash', True)
         return False
 
     def get_full_path_with_slash(self, request):
@@ -84,16 +84,15 @@ class CommonMiddleware(MiddlewareMixin):
         new_path = request.get_full_path(force_append_slash=True)
         # Prevent construction of scheme relative urls.
         new_path = escape_leading_slashes(new_path)
-        if settings.DEBUG and request.method in ("POST", "PUT", "PATCH"):
+        if settings.DEBUG and request.method in ('POST', 'PUT', 'PATCH'):
             raise RuntimeError(
                 "You called this URL via %(method)s, but the URL doesn't end "
                 "in a slash and you have APPEND_SLASH set. Django can't "
                 "redirect to the slash URL while maintaining %(method)s data. "
                 "Change your form to point to %(url)s (note the trailing "
-                "slash), or set APPEND_SLASH=False in your Django settings."
-                % {
-                    "method": request.method,
-                    "url": request.get_host() + new_path,
+                "slash), or set APPEND_SLASH=False in your Django settings." % {
+                    'method': request.method,
+                    'url': request.get_host() + new_path,
                 }
             )
         return new_path
@@ -110,32 +109,28 @@ class CommonMiddleware(MiddlewareMixin):
 
         # Add the Content-Length header to non-streaming responses if not
         # already set.
-        if not response.streaming and not response.has_header("Content-Length"):
-            response.headers["Content-Length"] = str(len(response.content))
+        if not response.streaming and not response.has_header('Content-Length'):
+            response.headers['Content-Length'] = str(len(response.content))
 
         return response
 
 
 class BrokenLinkEmailsMiddleware(MiddlewareMixin):
+
     def process_response(self, request, response):
         """Send broken link emails for relevant 404 NOT FOUND responses."""
         if response.status_code == 404 and not settings.DEBUG:
             domain = request.get_host()
             path = request.get_full_path()
-            referer = request.META.get("HTTP_REFERER", "")
+            referer = request.META.get('HTTP_REFERER', '')
 
             if not self.is_ignorable_request(request, path, domain, referer):
-                ua = request.META.get("HTTP_USER_AGENT", "<none>")
-                ip = request.META.get("REMOTE_ADDR", "<none>")
+                ua = request.META.get('HTTP_USER_AGENT', '<none>')
+                ip = request.META.get('REMOTE_ADDR', '<none>')
                 mail_managers(
-                    "Broken %slink on %s"
-                    % (
-                        (
-                            "INTERNAL "
-                            if self.is_internal_request(domain, referer)
-                            else ""
-                        ),
-                        domain,
+                    "Broken %slink on %s" % (
+                        ('INTERNAL ' if self.is_internal_request(domain, referer) else ''),
+                        domain
                     ),
                     "Referrer: %s\nRequested URL: %s\nUser agent: %s\n"
                     "IP address: %s\n" % (referer, path, ua, ip),
@@ -163,17 +158,17 @@ class BrokenLinkEmailsMiddleware(MiddlewareMixin):
 
         # APPEND_SLASH is enabled and the referer is equal to the current URL
         # without a trailing slash indicating an internal redirect.
-        if settings.APPEND_SLASH and uri.endswith("/") and referer == uri[:-1]:
+        if settings.APPEND_SLASH and uri.endswith('/') and referer == uri[:-1]:
             return True
 
         # A '?' in referer is identified as a search engine source.
-        if not self.is_internal_request(domain, referer) and "?" in referer:
+        if not self.is_internal_request(domain, referer) and '?' in referer:
             return True
 
         # The referer is equal to the current URL, ignoring the scheme (assumed
         # to be a poorly implemented bot).
         parsed_referer = urlparse(referer)
-        if parsed_referer.netloc in ["", domain] and parsed_referer.path == uri:
+        if parsed_referer.netloc in ['', domain] and parsed_referer.path == uri:
             return True
 
         return any(pattern.search(uri) for pattern in settings.IGNORABLE_404_URLS)

venv/Lib/site-packages/django/middleware/csrf.py

@@ -5,46 +5,32 @@ This module provides a middleware that implements protection
 against request forgeries from other sites.
 """
 import logging
+import re
 import string
-from collections import defaultdict
 from urllib.parse import urlparse
 
 from django.conf import settings
 from django.core.exceptions import DisallowedHost, ImproperlyConfigured
-from django.http import UnreadablePostError
-from django.http.request import HttpHeaders
 from django.urls import get_callable
 from django.utils.cache import patch_vary_headers
 from django.utils.crypto import constant_time_compare, get_random_string
 from django.utils.deprecation import MiddlewareMixin
-from django.utils.functional import cached_property
 from django.utils.http import is_same_domain
 from django.utils.log import log_response
-from django.utils.regex_helper import _lazy_re_compile
 
-logger = logging.getLogger("django.security.csrf")
-# This matches if any character is not in CSRF_ALLOWED_CHARS.
-invalid_token_chars_re = _lazy_re_compile("[^a-zA-Z0-9]")
+logger = logging.getLogger('django.security.csrf')
 
-REASON_BAD_ORIGIN = "Origin checking failed - %s does not match any trusted origins."
 REASON_NO_REFERER = "Referer checking failed - no Referer."
 REASON_BAD_REFERER = "Referer checking failed - %s does not match any trusted origins."
 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
-REASON_CSRF_TOKEN_MISSING = "CSRF token missing."
+REASON_BAD_TOKEN = "CSRF token missing or incorrect."
 REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
-REASON_INSECURE_REFERER = (
-    "Referer checking failed - Referer is insecure while host is secure."
-)
-# The reason strings below are for passing to InvalidTokenFormat. They are
-# phrases without a subject because they can be in reference to either the CSRF
-# cookie or non-cookie token.
-REASON_INCORRECT_LENGTH = "has incorrect length"
-REASON_INVALID_CHARACTERS = "has invalid characters"
+REASON_INSECURE_REFERER = "Referer checking failed - Referer is insecure while host is secure."
 
 CSRF_SECRET_LENGTH = 32
 CSRF_TOKEN_LENGTH = 2 * CSRF_SECRET_LENGTH
 CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits
-CSRF_SESSION_KEY = "_csrftoken"
+CSRF_SESSION_KEY = '_csrftoken'
 
 
 def _get_failure_view():
@@ -64,7 +50,7 @@ def _mask_cipher_secret(secret):
     mask = _get_new_csrf_string()
     chars = CSRF_ALLOWED_CHARS
     pairs = zip((chars.index(x) for x in secret), (chars.index(x) for x in mask))
-    cipher = "".join(chars[(x + y) % len(chars)] for x, y in pairs)
+    cipher = ''.join(chars[(x + y) % len(chars)] for x, y in pairs)
     return mask + cipher
 
 
@@ -78,19 +64,11 @@ def _unmask_cipher_token(token):
     token = token[CSRF_SECRET_LENGTH:]
     chars = CSRF_ALLOWED_CHARS
     pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in mask))
-    return "".join(chars[x - y] for x, y in pairs)  # Note negative values are ok
+    return ''.join(chars[x - y] for x, y in pairs)  # Note negative values are ok
 
 
-def _add_new_csrf_cookie(request):
-    """Generate a new random CSRF_COOKIE value, and add it to request.META."""
-    csrf_secret = _get_new_csrf_string()
-    request.META.update(
-        {
-            "CSRF_COOKIE": _mask_cipher_secret(csrf_secret),
-            "CSRF_COOKIE_NEEDS_UPDATE": True,
-        }
-    )
-    return csrf_secret
+def _get_new_csrf_token():
+    return _mask_cipher_secret(_get_new_csrf_string())
 
 
 def get_token(request):
@@ -103,14 +81,12 @@ def get_token(request):
     header to the outgoing response.  For this reason, you may need to use this
     function lazily, as is done by the csrf context processor.
     """
-    if "CSRF_COOKIE" in request.META:
-        csrf_secret = _unmask_cipher_token(request.META["CSRF_COOKIE"])
-        # Since the cookie is being used, flag to send the cookie in
-        # process_response() (even if the client already has it) in order to
-        # renew the expiry timer.
-        request.META["CSRF_COOKIE_NEEDS_UPDATE"] = True
+    if "CSRF_COOKIE" not in request.META:
+        csrf_secret = _get_new_csrf_string()
+        request.META["CSRF_COOKIE"] = _mask_cipher_secret(csrf_secret)
     else:
-        csrf_secret = _add_new_csrf_cookie(request)
+        csrf_secret = _unmask_cipher_token(request.META["CSRF_COOKIE"])
+    request.META["CSRF_COOKIE_USED"] = True
     return _mask_cipher_secret(csrf_secret)
 
 
@@ -119,21 +95,20 @@ def rotate_token(request):
     Change the CSRF token in use for a request - should be done on login
     for security purposes.
     """
-    _add_new_csrf_cookie(request)
-
-
-class InvalidTokenFormat(Exception):
-    def __init__(self, reason):
-        self.reason = reason
+    request.META.update({
+        "CSRF_COOKIE_USED": True,
+        "CSRF_COOKIE": _get_new_csrf_token(),
+    })
+    request.csrf_cookie_needs_reset = True
 
 
 def _sanitize_token(token):
-    if len(token) not in (CSRF_TOKEN_LENGTH, CSRF_SECRET_LENGTH):
-        raise InvalidTokenFormat(REASON_INCORRECT_LENGTH)
-    # Make sure all characters are in CSRF_ALLOWED_CHARS.
-    if invalid_token_chars_re.search(token):
-        raise InvalidTokenFormat(REASON_INVALID_CHARACTERS)
-    if len(token) == CSRF_SECRET_LENGTH:
+    # Allow only ASCII alphanumerics
+    if re.search('[^a-zA-Z0-9]', token):
+        return _get_new_csrf_token()
+    elif len(token) == CSRF_TOKEN_LENGTH:
+        return token
+    elif len(token) == CSRF_SECRET_LENGTH:
         # Older Django versions set cookies to values of CSRF_SECRET_LENGTH
         # alphanumeric characters. For backwards compatibility, accept
         # such values as unmasked secrets.
@@ -141,10 +116,10 @@ def _sanitize_token(token):
         # different code paths in the checks, although that might be a tad more
         # efficient.
         return _mask_cipher_secret(token)
-    return token
+    return _get_new_csrf_token()
 
 
-def _does_token_match(request_csrf_token, csrf_token):
+def _compare_masked_tokens(request_csrf_token, csrf_token):
     # Assume both arguments are sanitized -- that is, strings of
     # length CSRF_TOKEN_LENGTH, all CSRF_ALLOWED_CHARS.
     return constant_time_compare(
@@ -153,11 +128,6 @@ def _does_token_match(request_csrf_token, csrf_token):
     )
 
 
-class RejectRequest(Exception):
-    def __init__(self, reason):
-        self.reason = reason
-
-
 class CsrfViewMiddleware(MiddlewareMixin):
     """
     Require a present and correct csrfmiddlewaretoken for POST requests that
@@ -166,33 +136,6 @@ class CsrfViewMiddleware(MiddlewareMixin):
     This middleware should be used in conjunction with the {% csrf_token %}
     template tag.
     """
-
-    @cached_property
-    def csrf_trusted_origins_hosts(self):
-        return [
-            urlparse(origin).netloc.lstrip("*")
-            for origin in settings.CSRF_TRUSTED_ORIGINS
-        ]
-
-    @cached_property
-    def allowed_origins_exact(self):
-        return {origin for origin in settings.CSRF_TRUSTED_ORIGINS if "*" not in origin}
-
-    @cached_property
-    def allowed_origin_subdomains(self):
-        """
-        A mapping of allowed schemes to list of allowed netlocs, where all
-        subdomains of the netloc are allowed.
-        """
-        allowed_origin_subdomains = defaultdict(list)
-        for parsed in (
-            urlparse(origin)
-            for origin in settings.CSRF_TRUSTED_ORIGINS
-            if "*" in origin
-        ):
-            allowed_origin_subdomains[parsed.scheme].append(parsed.netloc.lstrip("*"))
-        return allowed_origin_subdomains
-
     # The _accept and _reject methods currently only exist for the sake of the
     # requires_csrf_token decorator.
     def _accept(self, request):
@@ -205,9 +148,7 @@ class CsrfViewMiddleware(MiddlewareMixin):
     def _reject(self, request, reason):
         response = _get_failure_view()(request, reason=reason)
         log_response(
-            "Forbidden (%s): %s",
-            reason,
-            request.path,
+            'Forbidden (%s): %s', reason, request.path,
             response=response,
             request=request,
             logger=logger,
@@ -220,9 +161,9 @@ class CsrfViewMiddleware(MiddlewareMixin):
                 return request.session.get(CSRF_SESSION_KEY)
             except AttributeError:
                 raise ImproperlyConfigured(
-                    "CSRF_USE_SESSIONS is enabled, but request.session is not "
-                    "set. SessionMiddleware must appear before CsrfViewMiddleware "
-                    "in MIDDLEWARE."
+                    'CSRF_USE_SESSIONS is enabled, but request.session is not '
+                    'set. SessionMiddleware must appear before CsrfViewMiddleware '
+                    'in MIDDLEWARE.'
                 )
         else:
             try:
@@ -230,23 +171,21 @@ class CsrfViewMiddleware(MiddlewareMixin):
             except KeyError:
                 return None
 
-            # This can raise InvalidTokenFormat.
             csrf_token = _sanitize_token(cookie_token)
-
             if csrf_token != cookie_token:
-                # Then the cookie token had length CSRF_SECRET_LENGTH, so flag
-                # to replace it with the masked version.
-                request.META["CSRF_COOKIE_NEEDS_UPDATE"] = True
+                # Cookie token needed to be replaced;
+                # the cookie needs to be reset.
+                request.csrf_cookie_needs_reset = True
             return csrf_token
 
-    def _set_csrf_cookie(self, request, response):
+    def _set_token(self, request, response):
         if settings.CSRF_USE_SESSIONS:
-            if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]:
-                request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"]
+            if request.session.get(CSRF_SESSION_KEY) != request.META['CSRF_COOKIE']:
+                request.session[CSRF_SESSION_KEY] = request.META['CSRF_COOKIE']
         else:
             response.set_cookie(
                 settings.CSRF_COOKIE_NAME,
-                request.META["CSRF_COOKIE"],
+                request.META['CSRF_COOKIE'],
                 max_age=settings.CSRF_COOKIE_AGE,
                 domain=settings.CSRF_COOKIE_DOMAIN,
                 path=settings.CSRF_COOKIE_PATH,
@@ -255,211 +194,136 @@ class CsrfViewMiddleware(MiddlewareMixin):
                 samesite=settings.CSRF_COOKIE_SAMESITE,
             )
             # Set the Vary header since content varies with the CSRF cookie.
-            patch_vary_headers(response, ("Cookie",))
-
-    def _origin_verified(self, request):
-        request_origin = request.META["HTTP_ORIGIN"]
-        try:
-            good_host = request.get_host()
-        except DisallowedHost:
-            pass
-        else:
-            good_origin = "%s://%s" % (
-                "https" if request.is_secure() else "http",
-                good_host,
-            )
-            if request_origin == good_origin:
-                return True
-        if request_origin in self.allowed_origins_exact:
-            return True
-        try:
-            parsed_origin = urlparse(request_origin)
-        except ValueError:
-            return False
-        request_scheme = parsed_origin.scheme
-        request_netloc = parsed_origin.netloc
-        return any(
-            is_same_domain(request_netloc, host)
-            for host in self.allowed_origin_subdomains.get(request_scheme, ())
-        )
-
-    def _check_referer(self, request):
-        referer = request.META.get("HTTP_REFERER")
-        if referer is None:
-            raise RejectRequest(REASON_NO_REFERER)
-
-        try:
-            referer = urlparse(referer)
-        except ValueError:
-            raise RejectRequest(REASON_MALFORMED_REFERER)
-
-        # Make sure we have a valid URL for Referer.
-        if "" in (referer.scheme, referer.netloc):
-            raise RejectRequest(REASON_MALFORMED_REFERER)
-
-        # Ensure that our Referer is also secure.
-        if referer.scheme != "https":
-            raise RejectRequest(REASON_INSECURE_REFERER)
-
-        if any(
-            is_same_domain(referer.netloc, host)
-            for host in self.csrf_trusted_origins_hosts
-        ):
-            return
-        # Allow matching the configured cookie domain.
-        good_referer = (
-            settings.SESSION_COOKIE_DOMAIN
-            if settings.CSRF_USE_SESSIONS
-            else settings.CSRF_COOKIE_DOMAIN
-        )
-        if good_referer is None:
-            # If no cookie domain is configured, allow matching the current
-            # host:port exactly if it's permitted by ALLOWED_HOSTS.
-            try:
-                # request.get_host() includes the port.
-                good_referer = request.get_host()
-            except DisallowedHost:
-                raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
-        else:
-            server_port = request.get_port()
-            if server_port not in ("443", "80"):
-                good_referer = "%s:%s" % (good_referer, server_port)
-
-        if not is_same_domain(referer.netloc, good_referer):
-            raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
-
-    def _bad_token_message(self, reason, token_source):
-        if token_source != "POST":
-            # Assume it is a settings.CSRF_HEADER_NAME value.
-            header_name = HttpHeaders.parse_header_name(token_source)
-            token_source = f"the {header_name!r} HTTP header"
-        return f"CSRF token from {token_source} {reason}."
-
-    def _check_token(self, request):
-        # Access csrf_token via self._get_token() as rotate_token() may have
-        # been called by an authentication middleware during the
-        # process_request() phase.
-        try:
-            csrf_token = self._get_token(request)
-        except InvalidTokenFormat as exc:
-            raise RejectRequest(f"CSRF cookie {exc.reason}.")
-
-        if csrf_token is None:
-            # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
-            # and in this way we can avoid all CSRF attacks, including login
-            # CSRF.
-            raise RejectRequest(REASON_NO_CSRF_COOKIE)
-
-        # Check non-cookie token for match.
-        request_csrf_token = ""
-        if request.method == "POST":
-            try:
-                request_csrf_token = request.POST.get("csrfmiddlewaretoken", "")
-            except UnreadablePostError:
-                # Handle a broken connection before we've completed reading the
-                # POST data. process_view shouldn't raise any exceptions, so
-                # we'll ignore and serve the user a 403 (assuming they're still
-                # listening, which they probably aren't because of the error).
-                pass
-
-        if request_csrf_token == "":
-            # Fall back to X-CSRFToken, to make things easier for AJAX, and
-            # possible for PUT/DELETE.
-            try:
-                request_csrf_token = request.META[settings.CSRF_HEADER_NAME]
-            except KeyError:
-                raise RejectRequest(REASON_CSRF_TOKEN_MISSING)
-            token_source = settings.CSRF_HEADER_NAME
-        else:
-            token_source = "POST"
-
-        try:
-            request_csrf_token = _sanitize_token(request_csrf_token)
-        except InvalidTokenFormat as exc:
-            reason = self._bad_token_message(exc.reason, token_source)
-            raise RejectRequest(reason)
-
-        if not _does_token_match(request_csrf_token, csrf_token):
-            reason = self._bad_token_message("incorrect", token_source)
-            raise RejectRequest(reason)
+            patch_vary_headers(response, ('Cookie',))
 
     def process_request(self, request):
-        try:
-            csrf_token = self._get_token(request)
-        except InvalidTokenFormat:
-            _add_new_csrf_cookie(request)
-        else:
-            if csrf_token is not None:
-                # Use same token next time.
-                request.META["CSRF_COOKIE"] = csrf_token
+        csrf_token = self._get_token(request)
+        if csrf_token is not None:
+            # Use same token next time.
+            request.META['CSRF_COOKIE'] = csrf_token
 
     def process_view(self, request, callback, callback_args, callback_kwargs):
-        if getattr(request, "csrf_processing_done", False):
+        if getattr(request, 'csrf_processing_done', False):
             return None
 
         # Wait until request.META["CSRF_COOKIE"] has been manipulated before
         # bailing out, so that get_token still works
-        if getattr(callback, "csrf_exempt", False):
+        if getattr(callback, 'csrf_exempt', False):
             return None
 
         # Assume that anything not defined as 'safe' by RFC7231 needs protection
-        if request.method in ("GET", "HEAD", "OPTIONS", "TRACE"):
-            return self._accept(request)
+        if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
+            if getattr(request, '_dont_enforce_csrf_checks', False):
+                # Mechanism to turn off CSRF checks for test suite.
+                # It comes after the creation of CSRF cookies, so that
+                # everything else continues to work exactly the same
+                # (e.g. cookies are sent, etc.), but before any
+                # branches that call reject().
+                return self._accept(request)
 
-        if getattr(request, "_dont_enforce_csrf_checks", False):
-            # Mechanism to turn off CSRF checks for test suite. It comes after
-            # the creation of CSRF cookies, so that everything else continues
-            # to work exactly the same (e.g. cookies are sent, etc.), but
-            # before any branches that call the _reject method.
-            return self._accept(request)
+            if request.is_secure():
+                # Suppose user visits http://example.com/
+                # An active network attacker (man-in-the-middle, MITM) sends a
+                # POST form that targets https://example.com/detonate-bomb/ and
+                # submits it via JavaScript.
+                #
+                # The attacker will need to provide a CSRF cookie and token, but
+                # that's no problem for a MITM and the session-independent
+                # secret we're using. So the MITM can circumvent the CSRF
+                # protection. This is true for any HTTP connection, but anyone
+                # using HTTPS expects better! For this reason, for
+                # https://example.com/ we need additional protection that treats
+                # http://example.com/ as completely untrusted. Under HTTPS,
+                # Barth et al. found that the Referer header is missing for
+                # same-domain requests in only about 0.2% of cases or less, so
+                # we can use strict Referer checking.
+                referer = request.META.get('HTTP_REFERER')
+                if referer is None:
+                    return self._reject(request, REASON_NO_REFERER)
 
-        # Reject the request if the Origin header doesn't match an allowed
-        # value.
-        if "HTTP_ORIGIN" in request.META:
-            if not self._origin_verified(request):
-                return self._reject(
-                    request, REASON_BAD_ORIGIN % request.META["HTTP_ORIGIN"]
+                referer = urlparse(referer)
+
+                # Make sure we have a valid URL for Referer.
+                if '' in (referer.scheme, referer.netloc):
+                    return self._reject(request, REASON_MALFORMED_REFERER)
+
+                # Ensure that our Referer is also secure.
+                if referer.scheme != 'https':
+                    return self._reject(request, REASON_INSECURE_REFERER)
+
+                # If there isn't a CSRF_COOKIE_DOMAIN, require an exact match
+                # match on host:port. If not, obey the cookie rules (or those
+                # for the session cookie, if CSRF_USE_SESSIONS).
+                good_referer = (
+                    settings.SESSION_COOKIE_DOMAIN
+                    if settings.CSRF_USE_SESSIONS
+                    else settings.CSRF_COOKIE_DOMAIN
                 )
-        elif request.is_secure():
-            # If the Origin header wasn't provided, reject HTTPS requests if
-            # the Referer header doesn't match an allowed value.
-            #
-            # Suppose user visits http://example.com/
-            # An active network attacker (man-in-the-middle, MITM) sends a
-            # POST form that targets https://example.com/detonate-bomb/ and
-            # submits it via JavaScript.
-            #
-            # The attacker will need to provide a CSRF cookie and token, but
-            # that's no problem for a MITM and the session-independent secret
-            # we're using. So the MITM can circumvent the CSRF protection. This
-            # is true for any HTTP connection, but anyone using HTTPS expects
-            # better! For this reason, for https://example.com/ we need
-            # additional protection that treats http://example.com/ as
-            # completely untrusted. Under HTTPS, Barth et al. found that the
-            # Referer header is missing for same-domain requests in only about
-            # 0.2% of cases or less, so we can use strict Referer checking.
-            try:
-                self._check_referer(request)
-            except RejectRequest as exc:
-                return self._reject(request, exc.reason)
+                if good_referer is not None:
+                    server_port = request.get_port()
+                    if server_port not in ('443', '80'):
+                        good_referer = '%s:%s' % (good_referer, server_port)
+                else:
+                    try:
+                        # request.get_host() includes the port.
+                        good_referer = request.get_host()
+                    except DisallowedHost:
+                        pass
 
-        try:
-            self._check_token(request)
-        except RejectRequest as exc:
-            return self._reject(request, exc.reason)
+                # Create a list of all acceptable HTTP referers, including the
+                # current host if it's permitted by ALLOWED_HOSTS.
+                good_hosts = list(settings.CSRF_TRUSTED_ORIGINS)
+                if good_referer is not None:
+                    good_hosts.append(good_referer)
+
+                if not any(is_same_domain(referer.netloc, host) for host in good_hosts):
+                    reason = REASON_BAD_REFERER % referer.geturl()
+                    return self._reject(request, reason)
+
+            # Access csrf_token via self._get_token() as rotate_token() may
+            # have been called by an authentication middleware during the
+            # process_request() phase.
+            csrf_token = self._get_token(request)
+            if csrf_token is None:
+                # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
+                # and in this way we can avoid all CSRF attacks, including login
+                # CSRF.
+                return self._reject(request, REASON_NO_CSRF_COOKIE)
+
+            # Check non-cookie token for match.
+            request_csrf_token = ""
+            if request.method == "POST":
+                try:
+                    request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
+                except OSError:
+                    # Handle a broken connection before we've completed reading
+                    # the POST data. process_view shouldn't raise any
+                    # exceptions, so we'll ignore and serve the user a 403
+                    # (assuming they're still listening, which they probably
+                    # aren't because of the error).
+                    pass
+
+            if request_csrf_token == "":
+                # Fall back to X-CSRFToken, to make things easier for AJAX,
+                # and possible for PUT/DELETE.
+                request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '')
+
+            request_csrf_token = _sanitize_token(request_csrf_token)
+            if not _compare_masked_tokens(request_csrf_token, csrf_token):
+                return self._reject(request, REASON_BAD_TOKEN)
 
         return self._accept(request)
 
     def process_response(self, request, response):
-        if request.META.get("CSRF_COOKIE_NEEDS_UPDATE"):
-            self._set_csrf_cookie(request, response)
-            # Unset the flag to prevent _set_csrf_cookie() from being
-            # unnecessarily called again in process_response() by other
-            # instances of CsrfViewMiddleware. This can happen e.g. when both a
-            # decorator and middleware are used. However,
-            # CSRF_COOKIE_NEEDS_UPDATE is still respected in subsequent calls
-            # e.g. in case rotate_token() is called in process_response() later
-            # by custom middleware but before those subsequent calls.
-            request.META["CSRF_COOKIE_NEEDS_UPDATE"] = False
+        if not getattr(request, 'csrf_cookie_needs_reset', False):
+            if getattr(response, 'csrf_cookie_set', False):
+                return response
 
+        if not request.META.get("CSRF_COOKIE_USED", False):
+            return response
+
+        # Set the CSRF cookie even if it's already set, so we renew
+        # the expiry timer.
+        self._set_token(request, response)
+        response.csrf_cookie_set = True
         return response

venv/Lib/site-packages/django/middleware/gzip.py

@@ -3,7 +3,7 @@ from django.utils.deprecation import MiddlewareMixin
 from django.utils.regex_helper import _lazy_re_compile
 from django.utils.text import compress_sequence, compress_string
 
-re_accepts_gzip = _lazy_re_compile(r"\bgzip\b")
+re_accepts_gzip = _lazy_re_compile(r'\bgzip\b')
 
 
 class GZipMiddleware(MiddlewareMixin):
@@ -12,19 +12,18 @@ class GZipMiddleware(MiddlewareMixin):
     Set the Vary header accordingly, so that caches will base their storage
     on the Accept-Encoding header.
     """
-
     def process_response(self, request, response):
         # It's not worth attempting to compress really short responses.
         if not response.streaming and len(response.content) < 200:
             return response
 
         # Avoid gzipping if we've already got a content-encoding.
-        if response.has_header("Content-Encoding"):
+        if response.has_header('Content-Encoding'):
             return response
 
-        patch_vary_headers(response, ("Accept-Encoding",))
+        patch_vary_headers(response, ('Accept-Encoding',))
 
-        ae = request.META.get("HTTP_ACCEPT_ENCODING", "")
+        ae = request.META.get('HTTP_ACCEPT_ENCODING', '')
         if not re_accepts_gzip.search(ae):
             return response
 
@@ -32,21 +31,21 @@ class GZipMiddleware(MiddlewareMixin):
             # Delete the `Content-Length` header for streaming content, because
             # we won't know the compressed size until we stream it.
             response.streaming_content = compress_sequence(response.streaming_content)
-            del response.headers["Content-Length"]
+            del response.headers['Content-Length']
         else:
             # Return the compressed content only if it's actually shorter.
             compressed_content = compress_string(response.content)
             if len(compressed_content) >= len(response.content):
                 return response
             response.content = compressed_content
-            response.headers["Content-Length"] = str(len(response.content))
+            response.headers['Content-Length'] = str(len(response.content))
 
         # If there is a strong ETag, make it weak to fulfill the requirements
         # of RFC 7232 section-2.1 while also allowing conditional request
         # matches on ETags.
-        etag = response.get("ETag")
+        etag = response.get('ETag')
         if etag and etag.startswith('"'):
-            response.headers["ETag"] = "W/" + etag
-        response.headers["Content-Encoding"] = "gzip"
+            response.headers['ETag'] = 'W/' + etag
+        response.headers['Content-Encoding'] = 'gzip'
 
         return response

venv/Lib/site-packages/django/middleware/http.py

@@ -1,4 +1,6 @@
-from django.utils.cache import cc_delim_re, get_conditional_response, set_response_etag
+from django.utils.cache import (
+    cc_delim_re, get_conditional_response, set_response_etag,
+)
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.http import parse_http_date_safe
 
@@ -9,19 +11,18 @@ class ConditionalGetMiddleware(MiddlewareMixin):
     Last-Modified header and the request has If-None-Match or If-Modified-Since,
     replace the response with HttpNotModified. Add an ETag header if needed.
     """
-
     def process_response(self, request, response):
         # It's too late to prevent an unsafe request with a 412 response, and
         # for a HEAD request, the response body is always empty so computing
         # an accurate ETag isn't possible.
-        if request.method != "GET":
+        if request.method != 'GET':
             return response
 
-        if self.needs_etag(response) and not response.has_header("ETag"):
+        if self.needs_etag(response) and not response.has_header('ETag'):
             set_response_etag(response)
 
-        etag = response.get("ETag")
-        last_modified = response.get("Last-Modified")
+        etag = response.get('ETag')
+        last_modified = response.get('Last-Modified')
         last_modified = last_modified and parse_http_date_safe(last_modified)
 
         if etag or last_modified:
@@ -36,5 +37,5 @@ class ConditionalGetMiddleware(MiddlewareMixin):
 
     def needs_etag(self, response):
         """Return True if an ETag header should be added to response."""
-        cache_control_headers = cc_delim_re.split(response.get("Cache-Control", ""))
-        return all(header.lower() != "no-store" for header in cache_control_headers)
+        cache_control_headers = cc_delim_re.split(response.get('Cache-Control', ''))
+        return all(header.lower() != 'no-store' for header in cache_control_headers)

venv/Lib/site-packages/django/middleware/locale.py

@@ -13,24 +13,14 @@ class LocaleMiddleware(MiddlewareMixin):
     current thread context. This allows pages to be dynamically translated to
     the language the user desires (if the language is available).
     """
-
     response_redirect_class = HttpResponseRedirect
 
     def process_request(self, request):
-        urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
-        (
-            i18n_patterns_used,
-            prefixed_default_language,
-        ) = is_language_prefix_patterns_used(urlconf)
-        language = translation.get_language_from_request(
-            request, check_path=i18n_patterns_used
-        )
+        urlconf = getattr(request, 'urlconf', settings.ROOT_URLCONF)
+        i18n_patterns_used, prefixed_default_language = is_language_prefix_patterns_used(urlconf)
+        language = translation.get_language_from_request(request, check_path=i18n_patterns_used)
         language_from_path = translation.get_language_from_path(request.path_info)
-        if (
-            not language_from_path
-            and i18n_patterns_used
-            and not prefixed_default_language
-        ):
+        if not language_from_path and i18n_patterns_used and not prefixed_default_language:
             language = settings.LANGUAGE_CODE
         translation.activate(language)
         request.LANGUAGE_CODE = translation.get_language()
@@ -38,43 +28,34 @@ class LocaleMiddleware(MiddlewareMixin):
     def process_response(self, request, response):
         language = translation.get_language()
         language_from_path = translation.get_language_from_path(request.path_info)
-        urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
-        (
-            i18n_patterns_used,
-            prefixed_default_language,
-        ) = is_language_prefix_patterns_used(urlconf)
+        urlconf = getattr(request, 'urlconf', settings.ROOT_URLCONF)
+        i18n_patterns_used, prefixed_default_language = is_language_prefix_patterns_used(urlconf)
 
-        if (
-            response.status_code == 404
-            and not language_from_path
-            and i18n_patterns_used
-            and prefixed_default_language
-        ):
+        if (response.status_code == 404 and not language_from_path and
+                i18n_patterns_used and prefixed_default_language):
             # Maybe the language code is missing in the URL? Try adding the
             # language prefix and redirecting to that URL.
-            language_path = "/%s%s" % (language, request.path_info)
+            language_path = '/%s%s' % (language, request.path_info)
             path_valid = is_valid_path(language_path, urlconf)
-            path_needs_slash = not path_valid and (
-                settings.APPEND_SLASH
-                and not language_path.endswith("/")
-                and is_valid_path("%s/" % language_path, urlconf)
+            path_needs_slash = (
+                not path_valid and (
+                    settings.APPEND_SLASH and not language_path.endswith('/') and
+                    is_valid_path('%s/' % language_path, urlconf)
+                )
             )
 
             if path_valid or path_needs_slash:
                 script_prefix = get_script_prefix()
                 # Insert language after the script prefix and before the
                 # rest of the URL
-                language_url = request.get_full_path(
-                    force_append_slash=path_needs_slash
-                ).replace(script_prefix, "%s%s/" % (script_prefix, language), 1)
-                # Redirect to the language-specific URL as detected by
-                # get_language_from_request(). HTTP caches may cache this
-                # redirect, so add the Vary header.
-                redirect = self.response_redirect_class(language_url)
-                patch_vary_headers(redirect, ("Accept-Language", "Cookie"))
-                return redirect
+                language_url = request.get_full_path(force_append_slash=path_needs_slash).replace(
+                    script_prefix,
+                    '%s%s/' % (script_prefix, language),
+                    1
+                )
+                return self.response_redirect_class(language_url)
 
         if not (i18n_patterns_used and language_from_path):
-            patch_vary_headers(response, ("Accept-Language",))
-        response.headers.setdefault("Content-Language", language)
+            patch_vary_headers(response, ('Accept-Language',))
+        response.headers.setdefault('Content-Language', language)
         return response

venv/Lib/site-packages/django/middleware/security.py

@@ -6,61 +6,52 @@ from django.utils.deprecation import MiddlewareMixin
 
 
 class SecurityMiddleware(MiddlewareMixin):
-    def __init__(self, get_response):
+    # RemovedInDjango40Warning: when the deprecation ends, replace with:
+    #   def __init__(self, get_response):
+    def __init__(self, get_response=None):
         super().__init__(get_response)
         self.sts_seconds = settings.SECURE_HSTS_SECONDS
         self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS
         self.sts_preload = settings.SECURE_HSTS_PRELOAD
         self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF
+        self.xss_filter = settings.SECURE_BROWSER_XSS_FILTER
         self.redirect = settings.SECURE_SSL_REDIRECT
         self.redirect_host = settings.SECURE_SSL_HOST
         self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT]
         self.referrer_policy = settings.SECURE_REFERRER_POLICY
-        self.cross_origin_opener_policy = settings.SECURE_CROSS_ORIGIN_OPENER_POLICY
 
     def process_request(self, request):
         path = request.path.lstrip("/")
-        if (
-            self.redirect
-            and not request.is_secure()
-            and not any(pattern.search(path) for pattern in self.redirect_exempt)
-        ):
+        if (self.redirect and not request.is_secure() and
+                not any(pattern.search(path)
+                        for pattern in self.redirect_exempt)):
             host = self.redirect_host or request.get_host()
             return HttpResponsePermanentRedirect(
                 "https://%s%s" % (host, request.get_full_path())
             )
 
     def process_response(self, request, response):
-        if (
-            self.sts_seconds
-            and request.is_secure()
-            and "Strict-Transport-Security" not in response
-        ):
+        if (self.sts_seconds and request.is_secure() and
+                'Strict-Transport-Security' not in response):
             sts_header = "max-age=%s" % self.sts_seconds
             if self.sts_include_subdomains:
                 sts_header = sts_header + "; includeSubDomains"
             if self.sts_preload:
                 sts_header = sts_header + "; preload"
-            response.headers["Strict-Transport-Security"] = sts_header
+            response.headers['Strict-Transport-Security'] = sts_header
 
         if self.content_type_nosniff:
-            response.headers.setdefault("X-Content-Type-Options", "nosniff")
+            response.headers.setdefault('X-Content-Type-Options', 'nosniff')
+
+        if self.xss_filter:
+            response.headers.setdefault('X-XSS-Protection', '1; mode=block')
 
         if self.referrer_policy:
             # Support a comma-separated string or iterable of values to allow
             # fallback.
-            response.headers.setdefault(
-                "Referrer-Policy",
-                ",".join(
-                    [v.strip() for v in self.referrer_policy.split(",")]
-                    if isinstance(self.referrer_policy, str)
-                    else self.referrer_policy
-                ),
-            )
+            response.headers.setdefault('Referrer-Policy', ','.join(
+                [v.strip() for v in self.referrer_policy.split(',')]
+                if isinstance(self.referrer_policy, str) else self.referrer_policy
+            ))
 
-        if self.cross_origin_opener_policy:
-            response.setdefault(
-                "Cross-Origin-Opener-Policy",
-                self.cross_origin_opener_policy,
-            )
         return response