From owner-svn-ports-all@freebsd.org Tue Apr 7 10:41:36 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4E6172B281D; Tue, 7 Apr 2020 10:41:36 +0000 (UTC) (envelope-from kai@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48xP8w1QWrz4RkJ; Tue, 7 Apr 2020 10:41:36 +0000 (UTC) (envelope-from kai@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 2C09D8511; Tue, 7 Apr 2020 10:41:36 +0000 (UTC) (envelope-from kai@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 037AfZkK028181; Tue, 7 Apr 2020 10:41:35 GMT (envelope-from kai@FreeBSD.org) Received: (from kai@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 037AfZmA028175; Tue, 7 Apr 2020 10:41:35 GMT (envelope-from kai@FreeBSD.org) Message-Id: <202004071041.037AfZmA028175@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kai set sender to kai@FreeBSD.org using -f From: Kai Knoblich Date: Tue, 7 Apr 2020 10:41:35 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r530965 - in head/www: . py-django-debreach X-SVN-Group: ports-head X-SVN-Commit-Author: kai X-SVN-Commit-Paths: in head/www: . py-django-debreach X-SVN-Commit-Revision: 530965 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Apr 2020 10:41:36 -0000 Author: kai Date: Tue Apr 7 10:41:34 2020 New Revision: 530965 URL: https://svnweb.freebsd.org/changeset/ports/530965 Log: [NEW PORT] www/py-django-debreach Basic/extra mitigation against the BREACH attack for Django projects. django-debreach provides additional protection to Django's built in CSRF token masking by randomizing the content length of each response. This is achieved by adding a random string of between 12 and 25 characters as a comment to the end of the HTML content. Note that this will only be applied to responses with a content type of text/html. WWW: https://github.com/lpomfrey/django-debreach Added: head/www/py-django-debreach/ head/www/py-django-debreach/Makefile (contents, props changed) head/www/py-django-debreach/distinfo (contents, props changed) head/www/py-django-debreach/pkg-descr (contents, props changed) Modified: head/www/Makefile Modified: head/www/Makefile ============================================================================== --- head/www/Makefile Tue Apr 7 10:28:01 2020 (r530964) +++ head/www/Makefile Tue Apr 7 10:41:34 2020 (r530965) @@ -1508,6 +1508,7 @@ SUBDIR += py-django-crispy-forms SUBDIR += py-django-cron SUBDIR += py-django-datetime-widget + SUBDIR += py-django-debreach SUBDIR += py-django-debug-toolbar SUBDIR += py-django-dpaste SUBDIR += py-django-evolution Added: head/www/py-django-debreach/Makefile ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/py-django-debreach/Makefile Tue Apr 7 10:41:34 2020 (r530965) @@ -0,0 +1,25 @@ +# $FreeBSD$ + +PORTNAME= django-debreach +PORTVERSION= 2.0.1 +CATEGORIES= www security python +MASTER_SITES= CHEESESHOP +PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX} + +MAINTAINER= kai@FreeBSD.org +COMMENT= Adds protection against the BREACH attack in Django + +LICENSE= BSD2CLAUSE +LICENSE_FILE= ${WRKSRC}/LICENSE + +TEST_DEPENDS= ${PYTHON_PKGNAMEPREFIX}django22>0:www/py-django22@${PY_FLAVOR} + +USES= python:3.5+ +USE_PYTHON= autoplist distutils + +NO_ARCH= yes + +do-test: + @cd ${WRKSRC} && ${PYTHON_CMD} runtests.py + +.include Added: head/www/py-django-debreach/distinfo ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/py-django-debreach/distinfo Tue Apr 7 10:41:34 2020 (r530965) @@ -0,0 +1,3 @@ +TIMESTAMP = 1586162610 +SHA256 (django-debreach-2.0.1.tar.gz) = 3dd90385918daef4951e67ef6c3dcb550ac5164d84f5cc9889ed52e312597d68 +SIZE (django-debreach-2.0.1.tar.gz) = 14592 Added: head/www/py-django-debreach/pkg-descr ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/py-django-debreach/pkg-descr Tue Apr 7 10:41:34 2020 (r530965) @@ -0,0 +1,10 @@ +Basic/extra mitigation against the BREACH attack for Django projects. + +django-debreach provides additional protection to Django's built in CSRF token +masking by randomizing the content length of each response. + +This is achieved by adding a random string of between 12 and 25 characters as a +comment to the end of the HTML content. Note that this will only be applied to +responses with a content type of text/html. + +WWW: https://github.com/lpomfrey/django-debreach