|
|
@@ -169,6 +169,11 @@ class SessionTestsMixin(object):
|
|
|
self.assertNotEqual(self.session.session_key, prev_key)
|
|
|
self.assertEqual(list(self.session.items()), prev_data)
|
|
|
|
|
|
+ def test_save_doesnt_clear_data(self):
|
|
|
+ self.session['a'] = 'b'
|
|
|
+ self.session.save()
|
|
|
+ self.assertEqual(self.session['a'], 'b')
|
|
|
+
|
|
|
def test_invalid_key(self):
|
|
|
# Submitting an invalid session key (either by guessing, or if the db has
|
|
|
# removed the key) results in a new key being generated.
|
|
|
@@ -305,6 +310,21 @@ class SessionTestsMixin(object):
|
|
|
self.session.delete(old_session_key)
|
|
|
self.session.delete(new_session_key)
|
|
|
|
|
|
+ def test_session_load_does_not_create_record(self):
|
|
|
+ """
|
|
|
+ Loading an unknown session key does not create a session record.
|
|
|
+
|
|
|
+ Creating session records on load is a DOS vulnerability.
|
|
|
+ """
|
|
|
+ if self.backend is CookieSession:
|
|
|
+ raise unittest.SkipTest("Cookie backend doesn't have an external store to create records in.")
|
|
|
+ session = self.backend('someunknownkey')
|
|
|
+ session.load()
|
|
|
+
|
|
|
+ self.assertFalse(session.exists(session.session_key))
|
|
|
+ # provided unknown key was cycled, not reused
|
|
|
+ self.assertNotEqual(session.session_key, 'someunknownkey')
|
|
|
+
|
|
|
|
|
|
class DatabaseSessionTests(SessionTestsMixin, TestCase):
|
|
|
|