mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 14:16:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

Browse Source 
Thanks to Guido Vranken for initial report.
This commit is contained in:
Florian Apolloner
2019-07-15 12:00:06 +02:00
committed by Carlton Gibson
parent 7f65974f82
commit 4b78420d25
5 changed files with 55 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tests/utils_tests/test_html.py
View File

@@ -90,6 +90,8 @@ class TestUtilsHtml(SimpleTestCase):
('&gotcha&#;<>', '&gotcha&#;<>'),
('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'),
('<script>alert()</script>&h', 'alert()h'),
('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),
('X<<<<br>br>br>br>X', 'XX'),
)
for value, output in items:
with self.subTest(value=value, output=output):