+46
-9
lines changedFilter options
+46
-9
lines changed Original file line number Diff line number Diff line change
@@ -428,14 +428,17 @@ def trim_punctuation(self, word):
428 428
potential_entity = middle[amp:]
429 429
escaped = html.unescape(potential_entity)
430 430
if escaped == potential_entity or escaped.endswith(";"):
431 -
rstripped = middle.rstrip(";")
432 -
amount_stripped = len(middle) - len(rstripped)
433 -
if amp > -1 and amount_stripped > 1:
434 -
# Leave a trailing semicolon as might be an entity.
435 -
trail = middle[len(rstripped) + 1 :] + trail
436 -
middle = rstripped + ";"
431 +
rstripped = middle.rstrip(self.trailing_punctuation_chars)
432 +
trail_start = len(rstripped)
433 +
amount_trailing_semicolons = len(middle) - len(middle.rstrip(";"))
434 +
if amp > -1 and amount_trailing_semicolons > 1:
435 +
# Leave up to most recent semicolon as might be an entity.
436 +
recent_semicolon = middle[trail_start:].index(";")
437 +
middle_semicolon_index = recent_semicolon + trail_start + 1
438 +
trail = middle[middle_semicolon_index:] + trail
439 +
middle = rstripped + middle[trail_start:middle_semicolon_index]
437 440
else:
438 -
trail = middle[len(rstripped) :] + trail
441 +
trail = middle[trail_start:] + trail
439 442
middle = rstripped
440 443
trimmed_something = True
441 444
@@ -2932,6 +2932,17 @@ Django's built-in :tfilter:`escape` filter. The default value for
2932 2932
email addresses that contain single quotes (``'``), things won't work as
2933 2933
expected. Apply this filter only to plain text.
2934 2934 2935 +
.. warning::
2936 + 2937 +
Using ``urlize`` or ``urlizetrunc`` can incur a performance penalty, which
2938 +
can become severe when applied to user controlled values such as content
2939 +
stored in a :class:`~django.db.models.TextField`. You can use
2940 +
:tfilter:`truncatechars` to add a limit to such inputs:
2941 + 2942 +
.. code-block:: html+django
2943 + 2944 +
{{ value|truncatechars:500|urlize }}
2945 + 2935 2946
.. templatefilter:: urlizetrunc
2936 2947 2937 2948
``urlizetrunc``
@@ -7,4 +7,9 @@ Django 4.2.16 release notes
7 7
Django 4.2.16 fixes one security issue with severity "moderate" and one
8 8
security issue with severity "low" in 4.2.15.
9 9 10 -
...
10 +
CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
11 +
===========================================================================================
12 + 13 +
:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
14 +
denial-of-service attack via very large inputs with a specific sequence of
15 +
characters.
Original file line number Diff line number Diff line change
@@ -7,4 +7,9 @@ Django 5.0.9 release notes
7 7
Django 5.0.9 fixes one security issue with severity "moderate" and one security
8 8
issue with severity "low" in 5.0.8.
9 9 10 -
...
10 +
CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
11 +
===========================================================================================
12 + 13 +
:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
14 +
denial-of-service attack via very large inputs with a specific sequence of
15 +
characters.
Original file line number Diff line number Diff line change
@@ -7,6 +7,13 @@ Django 5.1.1 release notes
7 7
Django 5.1.1 fixes one security issue with severity "moderate", one security
8 8
issue with severity "low", and several bugs in 5.1.
9 9 10 +
CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
11 +
===========================================================================================
12 + 13 +
:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
14 +
denial-of-service attack via very large inputs with a specific sequence of
15 +
characters.
16 + 10 17
Bugfixes
11 18
========
12 19
@@ -321,6 +321,11 @@ def test_trailing_semicolon(self):
321 321
'<a href="http://example.com?x=" rel="nofollow">'
322 322
"http://example.com?x=&</a>;;",
323 323
)
324 +
self.assertEqual(
325 +
urlize("http://example.com?x=&.;...;", autoescape=False),
326 +
'<a href="http://example.com?x=" rel="nofollow">'
327 +
"http://example.com?x=&</a>.;...;",
328 +
)
324 329 325 330
def test_brackets(self):
326 331
"""
@@ -375,6 +375,7 @@ def test_urlize_unchanged_inputs(self):
375 375
"&:" + ";" * 100_000,
376 376
"&.;" * 100_000,
377 377
".;" * 100_000,
378 +
"&" + ";:" * 100_000,
378 379
)
379 380
for value in tests:
380 381
with self.subTest(value=value):
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4