mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-26 11:49:12 +00:00
Code Issues 32 Releases Wiki Activity

[3.2.x] Fixed CVE-2022-41323 -- Prevented locales being interpreted as regular expressions.

Browse Source 
Thanks to Benjamin Balder Bach for the report.
This commit is contained in:
Adam Johnson 2022-09-02 09:44:05 +01:00 committed by Carlton Gibson
parent 33affaf0b6
commit 5b6b257fa7
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django/urls/resolvers.py
View File

@ -303,7 +303,7 @@ class LocalePrefixPattern:
@property @property
def regex(self): def regex(self):
# This is only used by reverse() and cached in _reverse_dict. # This is only used by reverse() and cached in _reverse_dict.
return re.compile(self.language_prefix) return re.compile(re.escape(self.language_prefix))
@property @property
def language_prefix(self): def language_prefix(self):

6
docs/releases/3.2.16.txt
View File

@ -6,4 +6,8 @@ Django 3.2.16 release notes
Django 3.2.16 fixes a security issue with severity "medium" in 3.2.15. Django 3.2.16 fixes a security issue with severity "medium" in 3.2.15.
... CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs
===================================================================================
Internationalized URLs were subject to potential denial of service attack via
the locale parameter.

6
tests/i18n/patterns/tests.py
View File

@ -172,6 +172,12 @@ class URLTranslationTests(URLTestCaseBase):
self.assertEqual(translate_url('/nl/gebruikers/', 'en'), '/en/users/') self.assertEqual(translate_url('/nl/gebruikers/', 'en'), '/en/users/')
self.assertEqual(translation.get_language(), 'nl') self.assertEqual(translation.get_language(), 'nl')
def test_locale_not_interepreted_as_regex(self):
with translation.override("e("):
# Would previously error:
# re.error: missing ), unterminated subpattern at position 1
reverse("users")
class URLNamespaceTests(URLTestCaseBase): class URLNamespaceTests(URLTestCaseBase):
""" """