Django v3.2 broken admin interface due to malicious JSON value

Hello everybody,

I've used a fuzzer on my Django v3.2 project that resulted in a broken admin interface. I'm not sure whether this is a bug or a rough edge case.

I'm using Python 3.9.13 with Django 3.2.18 with Postgres.

I have a Model with a JSONField and also added the model to my admin view (I don't use the JSON field on the list view / filter)

```
    data = models.JSONField(null=True, blank=True)
```

The fuzzer added (via an API view) a string with 10,000 characters to the data field. 

Every time I want to open the admin list view (and the malicious object is part of the page), my Django crashes with the following message:

> ValueError
> 
> Exceeds the limit (4300) for integer string conversion: value has 10000 digits; use sys.set_int_max_str_digits() to increase the limit

I have attached my Sentry stack trace as a screenshot.

If this is an intended behavior, I have to validate the data to prevent malicious strings. But it feels like the admin interface should be able to handle those JSON values.

It looks like the Python releases in Sep 2022 have to do with this bug/edge case: https://mail.python.org/archives/list/python-dev@python.org/message/B25APD6FF27NJWKTEGAFRUDNSVVAFIHQ/

Kind Regards,

Johannes

Re: Function-based Views vs Class-based Views

I would like to recommend this excellent guide by Luke Plant:

https://spookylukey.github.io/django-views-the-right-way/

Best regards,
Carsten


Am 06.03.23 um 21:19 schrieb Michael Starr:
> What are the pros and cons of either method of rendering HTTP request responses?
>
> https://www.geeksforgeeks.org/class-based-vs-function-based-views-which-one-is-better-to-use-in-django/
>
> In the article above it states that CBVs are DRYer, but I don't understand why. The article doesn't explain, it just states it.
>
> The rest of the article is pretty good but it's a pretty slim introduction.
>
> I thought many of you would like to chime in on this topic. Leave your opinion below! What do you use?
>
> Mike

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/010ccb6f-bd96-c42a-40cf-b4503708edf6%40cafu.de.

Re: Django Guide

Hello Abdullah, watch videos Denis Ivy in youtube

On Sun, Mar 5, 2023 at 8:58 PM Abdullah Niaz <abdullahniaz423@gmail.com> wrote:

Hello, My Name is Abdullah. I am pursuing my computer science degree & I am in the second semester. I learned Python At my school. Now, I want to learn Django. Can Anyone guide me 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ec131a61-b003-4979-bdb5-de5466bef6b2n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAJwZnddMo%3D0RT_OMw0fbo4quSiTtq7np6vV-W4YzJ%3D_d3%3Djkng%40mail.gmail.com.

Re: Django Guide

Hello  any tell which documents good for django rest Framework  using  polls app create crud operations 

On Mon, 6 Mar 2023, 07:35 Sandip Bhattacharya, <sandipb@showmethesource.org> wrote:

There is a good guide here as well: https://developer.mozilla.org/en-US/docs/Learn/Server-side/Django

- Sandip

On Mar 5, 2023, at 5:20 PM, Kennedy Saavedra <ksaavedrasu@gmail.com> wrote:

Hello Abdullah, this is the documentation of 

Django: https://docs.djangoproject.com/en/4.1/

Start from the basics

El dom, 5 mar 2023 a las 10:58, Abdullah Niaz (<abdullahniaz423@gmail.com>) escribió:

Hello, My Name is Abdullah. I am pursuing my computer science degree & I am in the second semester. I learned Python At my school. Now, I want to learn Django. Can Anyone guide me 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ec131a61-b003-4979-bdb5-de5466bef6b2n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAL-qgjfZ4MGpHOGMaAb%3Dcdw8UPE-RHRRs3Wu5na2TDA9k-Hg0g%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/4C318C9D-D1BF-4DCC-8533-C1F28ABE8C38%40showmethesource.org.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CABq3VLCBsj15wTpfZQfMOuXcYZsKNqvyJ0qXfLyGcnLvLh8XCg%40mail.gmail.com.

Re: Django Guide

There is a good guide here as well: https://developer.mozilla.org/en-US/docs/Learn/Server-side/Django

- Sandip

On Mar 5, 2023, at 5:20 PM, Kennedy Saavedra <ksaavedrasu@gmail.com> wrote:

Hello Abdullah, this is the documentation of 

Django: https://docs.djangoproject.com/en/4.1/

Start from the basics

El dom, 5 mar 2023 a las 10:58, Abdullah Niaz (<abdullahniaz423@gmail.com>) escribió:

Hello, My Name is Abdullah. I am pursuing my computer science degree & I am in the second semester. I learned Python At my school. Now, I want to learn Django. Can Anyone guide me 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ec131a61-b003-4979-bdb5-de5466bef6b2n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAL-qgjfZ4MGpHOGMaAb%3Dcdw8UPE-RHRRs3Wu5na2TDA9k-Hg0g%40mail.gmail.com.

Re: Django Guide

U should explore documentation and YouTube latest videos and create your own e commerce website project with rest framework 

On Sun, Mar 5, 2023, 9:28 PM Abdullah Niaz <abdullahniaz423@gmail.com> wrote:

Hello, My Name is Abdullah. I am pursuing my computer science degree & I am in the second semester. I learned Python At my school. Now, I want to learn Django. Can Anyone guide me 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ec131a61-b003-4979-bdb5-de5466bef6b2n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAL5Fy%3DD7BTi%2BJFxE%3DP4D%3DqgeyYHFkM7gBfBuwenTFA0KNPdquA%40mail.gmail.com.

Re: "Django road map and resources"

Like this 

On Fri, 3 Mar 2023, 17:08 Prosper Lekia, <lekiaprosper@gmail.com> wrote:

Hi Yaqiinso. Just start small. All you need is a good understanding of your project logic, and what you want to achieve. You can also try collaborating on a existing project. You can always reach out to me. I started Django with the docs, and by studying the code base of cloned projects. I have currently built a an ecommerce site, an online banking app, a delivery tracking app, and currently working on my startup, a social media site. With you knowledge you can build the project of your dreams.

On Wednesday, March 1, 2023 at 5:00:43 PM UTC+1 yaqiinso wrote:

Hello dear django developers i was learning django since december i understood all the basics like how create apps,models,views,url,some authentication like adding user,login and logout but still i can not make the projects of my dreams like building school management system software , E_commerce web, and so ,  where to go can  any one please give road map that takes me to my dream ..

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/f982abf5-a498-426c-b1fb-46aed5701596n%40googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAFbY-hZXvyQBOzL7vbmddN5H5dTz14oQcp_6hTJWgt5QSvGibw%40mail.gmail.com.