Package: django-careful-forms
Django Careful Forms is a small extension on top ofdjango’s Forms system. It
can help you discover potential security oversights in your forms.It will emit warnings if there are any fields defined on forms that have not
been accessed (the asumption beeing that not accessed fields will also not have
been rendered in the template / displayed to the user).ExampleConsider the following example:# models.py:classSomeModel(models.Model):name=models.CharField(max_length=100)email=models.CharField(max_length=100)is_admin=models.BooleanField()classSomeForm(ModelForm):classMeta:model=SomeModel# template:{{form.name}}{{form.email}}You might have noticed that the model form’sMetaclass misses anexcludedefinition for the is_admin field (assuming this is a form that is
going to be displayed to an end user).Now on first glance this won’t cause any problems since the template only
displays the name and email field. However by forgetting to exclude theis_adminfield you are allowing users to change state internal to your
application (and in this hypothetical example gain admin rights).If we changed this example to use careful-forms instead the missing field would
have triggerd a warning (or even an exception depending on settings, see below),
alerting you to the vulnerability.MotivationThe initial motivation for this package came from the recentlywell publicized
‘mass assignment’ vulnerabilityin the Rails framework. The specifics are not
important but the basic problem was unchecked assignment of request data into a
model.Of course django is not susceptible to this particular problem because of its
forms system. However even when using the forms system (especially when using
Model Forms) it is still possible to inadvertently allow request data to be
written to model fields that are supposed to be private (e.g. by forgetting to
exclude internal fields).The final trigger however was Erik Romijn’s nice talkBuilding secure Django
websitesat djangocon europe 2012 which explicitly mentions the forms pitfall
inslide 53ff.CompatibilityPython 2.6+django 1.3+InstallationThe easy & recommended way:#~pipinstall django-careful-formsUsageAdd"careful_forms.middleware.CarefulFormsMiddlware"to your projectssettings.MIDDLEWARE_CLASSES. You should add it near the beginning of the
list to make sure all forms are covered.For every form that you want to be monitored by django-careful-forms change
the base class of your forms tocareful_forms.forms.CarefulModelForm(orCarefulFormfor regular    forms)[1].[1]In case you already have a custom form base class you can also addCarefulFormMixinto it.Examples:classMyForm(CarefulForm):# ...classOtherForm(CarefulModelForm):# ...classYetMoreForms(CarefulFormMixin,CustomFormBaseClass):# ...SettingsCAREFUL_ENABLEDDefault:settings.DEBUGThis setting is the “main switch” for django-careful-forms. When set toTruethe recording of accessed form fields is active andwarningswill be
triggered for not accessed fields. Since the bookkeping machinery incurs a
(small) per-request overhaed it is by default only enabled inDEBUGmode.When set toFalseno pre-request runtime overhead is introduced.CAREFUL_EXCEPTION_ON_WARNINGDefault:FalseWhen set toTruean exception is raised instead of a warning whenever a not
accessed field is detected.