csv_import: handle null bytes (#53323)

src/authentic2/csv_import.py

@@ -172,8 +172,12 @@ class CsvImporter(object):
             if not dialect:
                 self.error = Error('unknown-csv-dialect', _('Unknown CSV dialect'))
                 return False
-            reader = UnicodeReader(input_fd, dialect)
-            self.rows = list(reader)
+            try:
+                reader = UnicodeReader(input_fd, dialect)
+                self.rows = list(reader)
+            except (csv.Error, TypeError) as e:
+                self.error = Error('csv-read-error', _('Cannot read CSV: %s') % e)
+                return False
             return True
 
         with input_fd:

tests/test_csv_import.py

@@ -93,6 +93,16 @@ def test_bad_csv_encoding(profile):
     assert importer.error == Error('bad-encoding')
 
 
+def test_null_byte(profile):
+    importer = CsvImporter()
+    assert not importer.run(b'email key,first_name\n1,\x00', 'ascii')
+    assert importer.error == Error('csv-read-error')
+
+    importer = CsvImporter()
+    assert not importer.run(b'\x00', 'ascii')
+    assert importer.error == Error('csv-read-error')
+
+
 def test_empty_header_row_error(profile, user_csv_importer_factory):
     importer = user_csv_importer_factory('\n1,2,3')
     assert not importer.run()