Django rest framework password security for <script>

Question

I have implemented user registration in Django Rest Framework but I don't know how to check for sql injection and etc.
For example a password like this: "< script>"

class UserRegisterSerializer(serializers.ModelSerializer):

def validate(self, data):
    password = data['password']
    password2 = data['password2']
    data.pop('password2')

    if password != password2:
        raise serializers.ValidationError({"password": "Passwords must match."})

    errors = dict()
    try:
        # validate the password and catch the exception
        validators.validate_password(password)

    # the exception raised here is different than serializers.ValidationError
    except exceptions.ValidationError as e:
        errors['password'] = list(e.messages)

    if errors:
        raise serializers.ValidationError(errors)

    return data

This code is in my settings:

AUTH_PASSWORD_VALIDATORS = [
{
    'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
},
{
    'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', #=> Default (8 characters)
    'OPTIONS': {
        'min_length': 4,
    }
},
{
    'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
},
{
    'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
},

See stackoverflow.com/q/3324798/1531971 stackoverflow.com/q/38523159/1531971 stackoverflow.com/q/17113712/1531971 stackoverflow.com/q/20468143/1531971 stackoverflow.com/q/46420168/1531971 etc. — user1531971
– user1531971, Commented Mar 4, 2019 at 18:42

Ramy Moussa · Accepted Answer · 2019-03-04 18:23:23Z

0

From Django official security docs. Security in Django

Django’s querysets are protected from SQL injection since their queries are constructed using query parameterization. A query’s SQL code is defined separately from the query’s parameters. Since parameters may be user-provided and therefore unsafe, they are escaped by the underlying database driver.

answered Mar 4, 2019 at 18:23

Ramy Moussa

5,9813 gold badges37 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Django rest framework password security for <script>

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related