wnyc / breach_buster Goto Github PK

Request Method: GET
Django Version: 1.4.2
Exception Type: ZeroDivisionError
Exception Value:
float division
Exception Location: /usr/local/virtualenvs/django/lib/python2.6/site-packages/breach_buster/middleware/gzip.py in compress_string, line 65
Python Executable:

Prevent an adversary from performing a query multiple times and averaging the results to find an approximation of the intended file size.

In some ways randomizing the placement of flushes can enhance the accuracy of a BREACH attack by providing insight to the subbyte consumption of bits. Think of it as dithering.

https://code.djangoproject.com/ticket/20869#comment:21

The GZip middleware shouldn't encode PNG, JPG, GIF and other files. It breaks the transparencies on certain image formats and it doesn't make sense to gzip already compressed file formats. A simple check in the middleware of the content-type to break and not encode is necessary.