From 8a88af3fca08b4d45e6d41e25232c92b5406906b Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Thu, 9 Apr 2026 09:47:29 +0200 Subject: [PATCH] Prevent nullbytes in input data globally --- src/pretix/base/middleware.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py index 677816723d..5c36e9d8a6 100644 --- a/src/pretix/base/middleware.py +++ b/src/pretix/base/middleware.py @@ -24,6 +24,7 @@ from urllib.parse import urlparse, urlsplit from zoneinfo import ZoneInfo, ZoneInfoNotFoundError from django.conf import settings +from django.core.exceptions import BadRequest from django.http import Http404, HttpRequest, HttpResponse from django.middleware.common import CommonMiddleware from django.urls import get_script_prefix, resolve @@ -346,6 +347,15 @@ class SecurityMiddleware(MiddlewareMixin): return resp + def process_request(self, request): + # Nullbytes in GET/POST parameters are mostly harmless, as they will later fail on database insertion, but it + # keeps spamming our error logs whenever someone tries to run a vulnerability scanner. + if "\x00" in request.META['QUERY_STRING'] or "%00" in request.META['QUERY_STRING']: + raise BadRequest("Invalid characters in input.") + if request.method in ('POST', 'PUT', 'PATCH') and request.POST: + if any("\x00" in value for key, value_list in request.POST.lists() for value in value_list): + raise BadRequest("Invalid characters in input.") + class CustomCommonMiddleware(CommonMiddleware):