a*f
发帖数: 1790 | 1 "The Django framework experienced a major denial-of-service vulnerability
because it did not validate the length of user input for passwords.5 What
can you expect from a project that uses an inferior language named after a
snake? We’re coffee people here!" | H*******g
发帖数: 6997 | | j******o
发帖数: 4219 | | a*f
发帖数: 1790 | 4 用Django的很多都不知道会有这样的问题。这里的用户不知道有多少人知道这个问题：
"In fact, the Django open source Python content management system suffered
from a well-publicized denial-of-service vulnerability because it used the
PBKDF2 algorithm and supported unlimited length passwords at the same time!
By sending very long passwords, attackers could force the systems running
Django to consume an inordinate amount of processor resources. A 1 megabyte
password submission could take up to a minute or more of CPU time! "
【在 j******o 的大作中提到】
: 只有没水平的人才会怪这个工具怪那个环境。
| a*f
发帖数: 1790 | 5 现在Django把PBKDF2的密码长度限制在4096个字节. |
|
