Jeff Triplett jefftriplett

Ways to hack django apps...

A page of ideas on how I would look to compromise Django applications..

XSS (Cross-Site-Scripting)

Django comes with a automatic HTML escaping filter, so most XSS is stopped by the automatic escaping in views

There are places where it doesn't work (e.g https://docs.djangoproject.com/en/3.0/ref/templates/language/#automatic-html-escaping)
If you use it inside tag attributes, you could escape the attribute and set other attributes (e.g. onclick)

POSTGRESQL CHEATSHEET

Basic commands

psql -U postgres

Some interesting flags (to see all, use -h or --help depending on your psql version):

-E: will describe the underlaying queries of the \ commands (cool for learning!)
-l: psql will list all databases and then exit (useful if the user you connect with doesn't has a default database, like at AWS RDS)

Speaker Rider

by Tatiana Mac

Last updated 14 April 2021

What is a speaker rider?

As speaking comes with immense privilege, I have crafted a speaker rider to set expectations and boundaries around my engagement. I am grateful to all the conference organisers who have brilliantly hosted me. I would love to continue to exercise this privilege to speak at conferences, and use this privilege to make the landscape more accessible and beneficial to tech's most historically excluded and marginalised communities.

Considerations

😫 I provide a lot of explanations for those of you who never had to consider these things. Most thoughtful conferences I've attended check most of these boxes intrinsically, particularly when conference runners are experienced speakers. They get it.

This has been replaced by a gem

Use gem install bunchcli to install, then run bunch -h for a list of commands.

	#NoEnv ; Recommended for performance and compatibility with future AutoHotkey releases.
	; #Warn ; Enable warnings to assist with detecting common errors.
	SendMode Input ; Recommended for new scripts due to its superior speed and reliability.
	SetWorkingDir %A_ScriptDir% ; Ensures a consistent starting directory.

	F12::ToggleTerminal()

	ShowAndPositionTerminal()
	{
	WinShow ahk_class CASCADIA_HOSTING_WINDOW_CLASS

	def pytest_configure(config):
	config.addinivalue_line(
	"markers", "enable_inline_css: run css postprocessing over generated emails"
	)

	@pytest.fixture(autouse=True)
	def disable_inline_css(request, monkeypatch):
	if "enable_inline_css" in request.keywords:
	return

	# /// script
	# requires-python = ">=3.12"
	# dependencies = [
	# "httpx",
	# "rich",
	# "typer",
	# ]
	# ///
	"""
	$ uv run django-top-100.py

	- name: Get VS Code versions
	run: curl --output vscode-stable-versions.json https://update.code.visualstudio.com/api/releases/stable
	- uses: actions/cache@v1
	with:
	path: .vscode-test/
	key: ${{ runner.os }}-vscode-test-${{ hashFiles('vscode-stable-versions.json') }}
	restore-keys: \|
	${{ runner.os }}-vscode-test-

	const MY_DOMAIN = "agodrich.com"
	const START_PAGE = "https://www.notion.so/gatsby-starter-notion-2c5e3d685aa341088d4cd8daca52fcc2"
	const DISQUS_SHORTNAME = "agodrich"

	addEventListener('fetch', event => {
	event.respondWith(fetchAndApply(event.request))
	})

	const corsHeaders = {
	"Access-Control-Allow-Origin": "*",

	from django.core.management import call_command
	from django.test import TestCase

	class MigrationsTestCase(TestCase):
	def test_no_outstanding_migrations(self):
	"""No migrations need to be generated"""
	try:
	result = call_command("makemigrations", "--dry-run", "--check", "--no-input", "-v", "0")
	except SystemExit:
	self.fail("There were outstanding migrations")