mirror of
https://github.com/django/django.git
synced 2025-10-31 09:41:08 +00:00
[5.1.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
This commit is contained in:
@@ -321,6 +321,11 @@ class FunctionTests(SimpleTestCase):
|
||||
'<a href="http://example.com?x=" rel="nofollow">'
|
||||
"http://example.com?x=&</a>;;",
|
||||
)
|
||||
self.assertEqual(
|
||||
urlize("http://example.com?x=&.;...;", autoescape=False),
|
||||
'<a href="http://example.com?x=" rel="nofollow">'
|
||||
"http://example.com?x=&</a>.;...;",
|
||||
)
|
||||
|
||||
def test_brackets(self):
|
||||
"""
|
||||
|
||||
Reference in New Issue
Block a user