mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 09:05:43 +00:00
Code Issues 25 Releases Wiki Activity

Refs CVE-2024-27351 -- Forwardported release notes and tests.

Browse Source 
Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
This commit is contained in:
Shai Berger 2024-02-19 13:56:37 +01:00 committed by Mariusz Felisiak
parent f5ed4306bb
commit f6ad8c7676
4 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/releases/3.2.25.txt
View File

@ -7,6 +7,14 @@ Django 3.2.25 release notes
Django 3.2.25 fixes a security issue with severity "moderate" and a regression
in 3.2.24.
CVE-2024-27351: Potential regular expression denial-of-service in ``django.utils.text.Truncator.words()``
=========================================================================================================
``django.utils.text.Truncator.words()`` method (with ``html=True``) and
:tfilter:`truncatewords_html` template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to :cve:`2019-14232` and :cve:`2023-43665`).
Bugfixes
========

8
docs/releases/4.2.11.txt
View File

@ -7,6 +7,14 @@ Django 4.2.11 release notes
Django 4.2.11 fixes a security issue with severity "moderate" and a regression
in 4.2.10.
CVE-2024-27351: Potential regular expression denial-of-service in ``django.utils.text.Truncator.words()``
=========================================================================================================
``django.utils.text.Truncator.words()`` method (with ``html=True``) and
:tfilter:`truncatewords_html` template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to :cve:`2019-14232` and :cve:`2023-43665`).
Bugfixes
========

8
docs/releases/5.0.3.txt
View File

@ -7,6 +7,14 @@ Django 5.0.3 release notes
Django 5.0.3 fixes a security issue with severity "moderate" and several bugs
in 5.0.2.
CVE-2024-27351: Potential regular expression denial-of-service in ``django.utils.text.Truncator.words()``
=========================================================================================================
``django.utils.text.Truncator.words()`` method (with ``html=True``) and
:tfilter:`truncatewords_html` template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to :cve:`2019-14232` and :cve:`2023-43665`).
Bugfixes
========

27
tests/utils_tests/test_text.py
View File

@ -292,6 +292,33 @@ class TestUtilsText(SimpleTestCase):
truncator = text.Truncator("foo</p>")
self.assertEqual("foo</p>", truncator.words(3, html=True))
# Only open brackets.
truncator = text.Truncator("<" * 60_000)
self.assertEqual(truncator.words(1, html=True), "&lt;…")
# Tags with special chars in attrs.
truncator = text.Truncator(
"""<i style="margin: 5%; font: *;">Hello, my dear lady!</i>"""
)
self.assertEqual(
"""<i style="margin: 5%; font: *;">Hello, my dear…</i>""",
truncator.words(3, html=True),
)
# Tags with special non-latin chars in attrs.
truncator = text.Truncator("""<p data-x="א">Hello, my dear lady!</p>""")
self.assertEqual(
"""<p data-x="א">Hello, my dear…</p>""",
truncator.words(3, html=True),
)
# Misplaced brackets.
truncator = text.Truncator("hello >< world")
self.assertEqual(truncator.words(1, html=True), "hello…")
self.assertEqual(truncator.words(2, html=True), "hello &gt;…")
self.assertEqual(truncator.words(3, html=True), "hello &gt;&lt;…")
self.assertEqual(truncator.words(4, html=True), "hello &gt;&lt; world")
@patch("django.utils.text.Truncator.MAX_LENGTH_HTML", 10_000)
def test_truncate_words_html_size_limit(self):
max_len = text.Truncator.MAX_LENGTH_HTML