Search code examples
pythondjangoregexsecurityurl-mapping

How to match any url contains a certain string (such as .jsp) in Django?

I'd like to soft reject any path that contains a string, such as .jsp in the Django 3. Here is my url.py:

from django.urls import re_path
from django.views.generic import TemplateView

re_path(
    r"^.*\.jsp\??.*$",
    TemplateView.as_view(template_name="404.txt", content_type="text/plain"),
),

The above path pattern can match an ordinary string like /whatever.jsp, but cannot match the following probing string. How to improve my re_path pattern to match this? Thanks!

/content/..%3B/crx/packmgr/list.jsp%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0A%3B%0Aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true
Solution

  • what about this regex r"[^\.](.*)\.jsp(.*)"