Django Security Interview Questions

I feel that every Django developer should know the answer to the questions below.

  • What is wrong with the following template snippet?
<a href="http://www.google.com/" class={{ user_class }} >Google</a>
  • Identify the security vulnerability in the following code. What is it? How can it be exploited?
class CatViewer(TemplateView):
    template_name = 'view_cats.html'

    def post(self, request, *args, **kwargs):
        form = CatViewForm(self.request.POST)
        if not form.is_valid():
            return self.get(request, form=form)
        form.instance.cat_image = b64encode(urlopen(form.instance.picture_url).read())
        form.save()
        return redirect('cat_viewer')


    def get_context_data(self, **kwargs):
        return {
            'form': kwargs['form'] if 'form' in kwargs else CatViewForm(),
            'cat_pics': CatView.objects.all(),
        }
  • Provide ways to identify a Django application during a blackbox test?
  • What is the default password hash algorithm that Django uses? Were there any recent changes?
  • Given a Django settings file, which items would stand out (whether they are missing or not) and why?
  • How does Django know to escape certain values?
  • Are Django values “safe” when rendered in Javascript?
  • Is it possible to execute a mass assignment attack against a Django model? If yes, how and when?
  • What parts of Django are susceptible to SQL injection attacks and how does Django defend against these attacks?
  • Why is the SECRET_KEY so important?
  • When looking for a denial of service vector, which part of Django stands out as the most vulnerable?
  • Is Django threadsafe? If not, how does this effect the security of the application?
  • How does Django’s permission model work? Is it effective?
  • How does Django’s file uploading functionality work? How would you make it more secure?
  • How does Django deal with directory traversal vulnerabilities?
  • How does Django deal with CSRF? Is it totally effective?