django-pfx 1.7.6.dev21__tar.gz → 1.7.6.dev23__tar.gz

{django_pfx-1.7.6.dev21 → django_pfx-1.7.6.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev21
+Version: 1.7.6.dev23
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.7.6.dev21 → django_pfx-1.7.6.dev23}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev21
+Version: 1.7.6.dev23
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.7.6.dev21 → django_pfx-1.7.6.dev23}/django_pfx.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
   "tag": "1.7.5",
-  "distance": 21,
-  "node": "g98a0193f46175f1dd1f3465750eda84d310bdbfc",
+  "distance": 23,
+  "node": "g844445a9b16ab6666628821913df2ba5050b36d4",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-05"

{django_pfx-1.7.6.dev21 → django_pfx-1.7.6.dev23}/pfx/pfxcore/fields/media_field.py

@@ -1,7 +1,9 @@
+import base64
+import binascii
 import io
 import logging
 from importlib import import_module
-from urllib.request import urlopen
+from urllib.parse import unquote_to_bytes
 
 from django.core.exceptions import ValidationError
 from django.db import models
@@ -15,6 +17,30 @@ logger = logging.getLogger(__name__)
 DEFAULT_KEYS = {"key", "name", "content-type", "content-length"}
 
 
+def decode_data_uri(value):
+    """Return the bytes carried by a ``data:`` URI, and only that.
+
+    The uploaded content reaches the server as this string. It used to be
+    handed to ``urlopen``, which also opens ``file://`` and ``http://``:
+    a client could then have the server read a local file or reach the
+    internal network. Only the ``data:`` scheme is accepted here, and it
+    is decoded in place, never opened.
+
+    :raises ValidationError: when the value is not a valid ``data:`` URI
+    """
+    if not isinstance(value, str) or not value.startswith('data:'):
+        raise ValidationError("Le contenu doit être une URI « data: ».")
+    header, sep, data = value[len('data:'):].partition(',')
+    if not sep:
+        raise ValidationError("URI « data: » invalide.")
+    if ';base64' in header:
+        try:
+            return base64.b64decode(data, validate=True)
+        except (binascii.Error, ValueError):
+            raise ValidationError("URI « data: » invalide.")
+    return unquote_to_bytes(data)
+
+
 def get_storage_class(class_path):
     ps = class_path.split('.')
     return getattr(import_module('.'.join(ps[:-1])), ps[-1])()
@@ -91,8 +117,10 @@ class MediaField(models.JSONField):
             after_save.append(lambda: self.delete(self._db_value))
             setattr(obj, self.name, None)
         if b64:
-            with urlopen(b64) as response:
-                file = response.read()
+            try:
+                file = decode_data_uri(b64)
+            except ValidationError as e:
+                raise ValidationError({self.name: e.messages})
             setattr(obj, self.name, dict(key=self.get_key(obj, name)))
             after_save.append(lambda: save_file(obj, file, name))
         return after_save

{django_pfx-1.7.6.dev21 → django_pfx-1.7.6.dev23}/tests/tests/basic_api_test.py

@@ -847,6 +847,37 @@ class BasicAPITest(TestAssertMixin, TestCase):
         self.assertJE(response, 'local_file', None)
         self.assertFalse(Path(f'/tmp/django-pfx-filestore/{key2}').exists())
 
+    def test_create_file_rejects_non_data_uri(self):
+        """A media upload only accepts a ``data:`` URI.
+
+        The content used to be handed to ``urlopen``, so ``file://`` made
+        the server read a local file and ``http://`` reach the network.
+        Both are refused now, with a field error, before anything is read.
+        """
+        for uri in (
+                'file:///etc/hostname',
+                'http://169.254.169.254/latest/meta-data/',
+                'not a uri at all'):
+            response = self.client.post('/api/books', dict(
+                name="Test Book",
+                author=self.author1.pk,
+                pub_date='2000-01-01',
+                local_file=dict(name='x.txt', base64=uri)))
+            self.assertRC(response, 422)
+            self.assertJEExists(response, 'local_file')
+
+    def test_create_file_url_encoded_data_uri(self):
+        """A ``data:`` URI without ``;base64`` is percent-decoded, as
+        ``urlopen`` did, so that path keeps working without it."""
+        response = self.client.post('/api/books', dict(
+            name="Test Book",
+            author=self.author1.pk,
+            pub_date='2000-01-01',
+            local_file=dict(
+                name='test.txt', base64='data:text/plain,Hello%20world')))
+        self.assertRC(response, 200)
+        self.assertJE(response, 'local_file.content-length', '11')
+
     def test_get_file_content_disposition(self):
         """The file name must survive both local serving paths.