You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have observed that the serializer converts a int parameter to object, even if int lookup is forbidden.
My serializer is: foo = serializers.PrimaryKeyRelatedField(pk_field=HashidSerializerCharField(), queryset=Foo.objects.all(), required=False)
Then I have a validate method: def validate_foo(self, value)
Both integer and string parameter triggers the validate_foo method with the retrieved object in argument.
However, HASHID_FIELD_ALLOW_INT_LOOKUP is False.
This leads to a security hole, where a user can retrieve the integer behind the obfuscated id of its objects.
The text was updated successfully, but these errors were encountered:
Thanks for catching this... I have never used my own module with any writable DRF APIs, so just hadn't dog-fooded this particular issue, and haven't touched the DRF stuff much since the original release. I have modified HashidSerializerCharField to now disallow int lookups if allow_int_lookup is false.
Hello,
I have observed that the serializer converts a int parameter to object, even if int lookup is forbidden.
My serializer is:
foo = serializers.PrimaryKeyRelatedField(pk_field=HashidSerializerCharField(), queryset=Foo.objects.all(), required=False)
Then I have a validate method:
def validate_foo(self, value)
Both integer and string parameter triggers the validate_foo method with the retrieved object in argument.
However, HASHID_FIELD_ALLOW_INT_LOOKUP is False.
This leads to a security hole, where a user can retrieve the integer behind the obfuscated id of its objects.
The text was updated successfully, but these errors were encountered: