CVE ID(s)

There's no CVE for this.

Report

When a Django project is created, the CSRF middleware is activated by default in the MIDDLEWARE setting, thereby providing CSRF protection to all the views. It is also possible to disable this to make development easier and unless decorators such as csrf_protect() is used to protect the every single critical views, the application will be vulnerable to Cross-Site Request Forgery (CWE-352).

CSRF Protection can be enabled/ Disabled by adding/ removing the django.middleware.csrf.CsrfViewMiddleware from the MIDDLEWARE variable.

This PR adds a CodeQL query with unit tests, which checks if any forms of CSRF prevention mechanism is enabled.

CSRF mechanism tested:

1. Presence of django.middleware.csrf.CsrfViewMiddleware in MIDDLEWARE variable.
2. Presence of any decorators such as requires_csrf_token(), ensure_csrf_cookie(), csrf_protect()
3. Presence of import of CsrfViewMiddleware class
   The details are present in PR: github/codeql#3296

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing