I wrote this code to to perform the following:
- I will remove the "spaces" within the url.
- Return welcome message.
- Redirect the user to different url.
- Compute HMAC for the request.
- Return and revoke the user profile picture.
Would someone please help me in checking if my code contains any security issues that I should avoid?
import base64
import mimetypes
import os
import hashlib
import hmac
import requests
from django.core.urlresolvers import reverse
from django.http import HttpResponse
from django.shortcuts import redirect, render
from django.views.decorators.csrf import csrf_exempt
def ordenary(s):
return s.strip().replace(' ', '').lower()
def form_of_message(request):
env = {'message': request.GET.get('message', 'hello')}
response = render(request, 'forms/message_form.html', env)
response.set_cookie(key='message_rendered_at', value=time.time())
return response
def proxy(request):
url = request.GET.get('url')
return redirect(url)
def compute_hmac_signature(message, key):
key = bytes(key, 'UTF-8')
message = bytes(message, 'UTF-8')
digest = hmac.new(key, message, hashlib.sha1).hexdigest()
return "sha1={}".format(str(digest))
def user_pic(request):
"""A view that returns the user's avatar image"""
base_path = os.path.join(os.path.dirname(__file__), '../../images/avatars')
filename = request.GET.get('u')
try:
data = open(os.path.join(base_path, filename), 'rb').read()
except IOError:
return render(request, 'templates/avatar.html')
return HttpResponse(data, content_type=mimetypes.guess_type(filename)[0])
