mirror of
https://github.com/django/django.git
synced 2025-10-31 09:41:08 +00:00
[5.0.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.
Thanks sw0rd1ight for the report.
Backport of 55d89e25f4 from main.
This commit is contained in:
@@ -1,6 +1,7 @@
|
||||
import gzip
|
||||
import re
|
||||
import secrets
|
||||
import textwrap
|
||||
import unicodedata
|
||||
from gzip import GzipFile
|
||||
from gzip import compress as gzip_compress
|
||||
@@ -97,24 +98,15 @@ def wrap(text, width):
|
||||
``width``.
|
||||
"""
|
||||
|
||||
def _generator():
|
||||
for line in text.splitlines(True): # True keeps trailing linebreaks
|
||||
max_width = min((line.endswith("\n") and width + 1 or width), width)
|
||||
while len(line) > max_width:
|
||||
space = line[: max_width + 1].rfind(" ") + 1
|
||||
if space == 0:
|
||||
space = line.find(" ") + 1
|
||||
if space == 0:
|
||||
yield line
|
||||
line = ""
|
||||
break
|
||||
yield "%s\n" % line[: space - 1]
|
||||
line = line[space:]
|
||||
max_width = min((line.endswith("\n") and width + 1 or width), width)
|
||||
if line:
|
||||
yield line
|
||||
|
||||
return "".join(_generator())
|
||||
wrapper = textwrap.TextWrapper(
|
||||
width=width,
|
||||
break_long_words=False,
|
||||
break_on_hyphens=False,
|
||||
)
|
||||
result = []
|
||||
for line in text.splitlines(True):
|
||||
result.extend(wrapper.wrap(line))
|
||||
return "\n".join(result)
|
||||
|
||||
|
||||
def add_truncation_text(text, truncate=None):
|
||||
|
||||
Reference in New Issue
Block a user