Skip to content

Commit b805bfb

Browse files
TBX3Dvmfunc
TBX3D
and
vmfunc
authored
fix(frameworks): stop django source prose from faking detection (#328)
the django detector keyed on the import paths django.contrib and django.core, which appear only in tutorials and settings snippets and never in a rendered response, so any two of them crossed the threshold and fingerprinted a docs page as a live django server. replace the source tokens with real response artifacts: the csrfmiddlewaretoken hidden field, the csrftoken cookie and the /static/admin/ asset path. Co-authored-by: vmfunc <vmfunc.lc@gmail.com>
1 parent 1820ba2 commit b805bfb

2 files changed

Lines changed: 4 additions & 3 deletions

File tree

‎internal/scan/frameworks/detectors/accuracy_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ func TestDetectorAccuracy_FalsePositives(t *testing.T) {
3939
{"Shopify cdn body only", &shopifyDetector{}, `<script src="https://cdn.shopify.com/s/buy-button.js"></script>`, http.Header{}},
4040
{"Spring Boot tutorial prose", &springBootDetector{}, `<article>To fix the Whitelabel Error Page in Spring Boot, add a controller.</article>`, http.Header{}},
4141
{"Remix audio asset", &remixDetector{}, `<audio src="/audio/track_remix.mp3"></audio>`, http.Header{}},
42+
{"Django settings tutorial", &djangoDetector{}, `<pre>INSTALLED_APPS = ['django.contrib.admin', 'django.contrib.auth']
43+
from django.core.exceptions import ValidationError</pre>`, http.Header{}},
4244
{"Magento migration guide with image mime", &magentoDetector{}, `<article><h1>How to migrate your Magento store</h1><img src="/logo.png" type="image/png"> A guide to Magento 2.</article>`, http.Header{}},
4345
{"Gatsby plugin comparison prose", &gatsbyDetector{}, `<article>gatsby-image and gatsby-plugin-sharp used to be the standard way to handle images before gatsby-plugin-image.</article>`, http.Header{}},
4446
{"Svelte ecosystem comparison prose", &svelteDetector{}, `<article>popular svelte-native and svelte-check tools round out the ecosystem.</article>`, http.Header{}},
@@ -65,6 +67,7 @@ func TestDetectorAccuracy_TruePositives(t *testing.T) {
6567
{"Shopify storefront header", &shopifyDetector{}, "", accHeader("X-Shopify-Stage", "production")},
6668
{"Spring Boot whitelabel page", &springBootDetector{}, `<html><body><h1>Whitelabel Error Page</h1><p>This application has no explicit mapping for /error</p><div>There was an unexpected error (type=Not Found, status=404).</div></body></html>`, http.Header{}},
6769
{"Remix context", &remixDetector{}, `<script>window.__remixContext = {"state":{}};</script>`, http.Header{}},
70+
{"Django admin login form", &djangoDetector{}, `<html><head><link rel="stylesheet" href="/static/admin/css/login.css"></head><body><form><input type="hidden" name="csrfmiddlewaretoken" value="abc"></form></body></html>`, accHeader("Set-Cookie", "csrftoken=xyz; Path=/")},
6871
{"Magento storefront markup", &magentoDetector{}, `<html><head><link rel="stylesheet" href="/static/frontend/Magento/luma/en_US/css/styles.css"></head><body data-mage-init='{"cookieStatus": {}}'></body></html>`, http.Header{}},
6972
{"Gatsby root div and page-data", &gatsbyDetector{}, `<html><body><div id="___gatsby"><script src="/page-data/index/page-data.json"></script></div></body></html>`, http.Header{}},
7073
{"Svelte runtime global and internal import", &svelteDetector{}, `<script>window.__svelte = {}; import { onMount } from "svelte/internal";</script>`, http.Header{}},

‎internal/scan/frameworks/detectors/backend.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,7 @@ func (d *djangoDetector) Signatures() []fw.Signature {
9191
// never a header, so this must not be HeaderOnly.
9292
{Pattern: "csrfmiddlewaretoken", Weight: 0.4},
9393
{Pattern: "csrftoken", Weight: 0.3, HeaderOnly: true},
94-
{Pattern: "django.contrib", Weight: 0.3},
95-
{Pattern: "django.core", Weight: 0.3},
96-
{Pattern: "__admin_media_prefix__", Weight: 0.3},
94+
{Pattern: "/static/admin/", Weight: 0.3},
9795
}
9896
}
9997

0 commit comments

Comments
 (0)