mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant().

Browse Source 
Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.
This commit is contained in:
Sarah Boyce
2024-06-26 12:11:54 +02:00
committed by Natalia
parent fe4a0bbe20
commit 9e9792228a
5 changed files with 71 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tests/i18n/tests.py
View File

@@ -58,6 +58,7 @@ from django.utils.translation.reloader import (
translation_file_changed,
watch_for_translation_changes,
)
from django.utils.translation.trans_real import LANGUAGE_CODE_MAX_LENGTH
from .forms import CompanyForm, I18nForm, SelectDateForm
from .models import Company, TestModel
@@ -1672,6 +1673,16 @@ class MiscTests(SimpleTestCase):
g("xyz")
with self.assertRaises(LookupError):
g("xy-zz")
msg = "'lang_code' exceeds the maximum accepted length"
with self.assertRaises(LookupError):
g("x" * LANGUAGE_CODE_MAX_LENGTH)
with self.assertRaisesMessage(ValueError, msg):
g("x" * (LANGUAGE_CODE_MAX_LENGTH + 1))
# 167 * 3 = 501 which is LANGUAGE_CODE_MAX_LENGTH + 1.
self.assertEqual(g("en-" * 167), "en")
with self.assertRaisesMessage(ValueError, msg):
g("en-" * 167, strict=True)
self.assertEqual(g("en-" * 30000), "en") # catastrophic test
def test_get_supported_language_variant_null(self):
g = trans_null.get_supported_language_variant