+37
-8
lines changedFilter options
+37
-8
lines changed Original file line number Diff line number Diff line change
@@ -27,8 +27,8 @@ def capfirst(x):
27 27 28 28 29 29
# Set up regular expressions
30 -
re_words = re.compile(r'<.*?>|((?:\w[-\w]*|&.*?;)+)', re.U | re.S)
31 -
re_chars = re.compile(r'<.*?>|(.)', re.U | re.S)
30 +
re_words = re.compile(r'<[^>]+?>|([^<>\s]+)', re.S)
31 +
re_chars = re.compile(r'<[^>]+?>|(.)', re.S)
32 32
re_tag = re.compile(r'<(/)?(\S+?)(?:(\s*/)|\s.*?)?>', re.S)
33 33
re_newlines = re.compile(r'\r\n|\r') # Used in normalize_newlines
34 34
re_camel_case = re.compile(r'(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
@@ -5,3 +5,17 @@ Django 1.11.23 release notes
5 5
*August 1, 2019*
6 6 7 7
Django 1.11.23 fixes security issues in 1.11.22.
8 + 9 +
CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``
10 +
================================================================================
11 + 12 +
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods
13 +
were passed the ``html=True`` argument, they were extremely slow to evaluate
14 +
certain inputs due to a catastrophic backtracking vulnerability in a regular
15 +
expression. The ``chars()`` and ``words()`` methods are used to implement the
16 +
:tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template
17 +
filters, which were thus vulnerable.
18 + 19 +
The regular expressions used by ``Truncator`` have been simplified in order to
20 +
avoid potential backtracking issues. As a consequence, trailing punctuation may
21 +
now at times be included in the truncated output.
Original file line number Diff line number Diff line change
@@ -19,13 +19,13 @@ def test_truncate(self):
19 19
def test_truncate2(self):
20 20
self.assertEqual(
21 21
truncatewords_html('<p>one <a href="#">two - three <br>four</a> five</p>', 4),
22 -
'<p>one <a href="#">two - three <br>four ...</a></p>',
22 +
'<p>one <a href="#">two - three ...</a></p>',
23 23
)
24 24 25 25
def test_truncate3(self):
26 26
self.assertEqual(
27 27
truncatewords_html('<p>one <a href="#">two - three <br>four</a> five</p>', 5),
28 -
'<p>one <a href="#">two - three <br>four</a> five</p>',
28 +
'<p>one <a href="#">two - three <br>four ...</a></p>',
29 29
)
30 30 31 31
def test_truncate4(self):
@@ -88,6 +88,16 @@ def test_truncate_chars(self):
88 88
# lazy strings are handled correctly
89 89
self.assertEqual(text.Truncator(lazystr('The quick brown fox')).chars(12), 'The quick...')
90 90 91 +
def test_truncate_chars_html(self):
92 +
perf_test_values = [
93 +
(('</a' + '\t' * 50000) + '//>', None),
94 +
('&' * 50000, '&' * 7 + '...'),
95 +
('_X<<<<<<<<<<<>', None),
96 +
]
97 +
for value, expected in perf_test_values:
98 +
truncator = text.Truncator(value)
99 +
self.assertEqual(expected if expected else value, truncator.chars(10, html=True))
100 + 91 101
def test_truncate_words(self):
92 102
truncator = text.Truncator('The quick brown fox jumped over the lazy dog.')
93 103
self.assertEqual('The quick brown fox jumped over the lazy dog.', truncator.words(10))
@@ -137,11 +147,16 @@ def test_truncate_html_words(self):
137 147
truncator = text.Truncator('<i>Buenos días! ¿Cómo está?</i>')
138 148
self.assertEqual('<i>Buenos días! ¿Cómo...</i>', truncator.words(3, '...', html=True))
139 149
truncator = text.Truncator('<p>I <3 python, what about you?</p>')
140 -
self.assertEqual('<p>I <3 python...</p>', truncator.words(3, '...', html=True))
150 +
self.assertEqual('<p>I <3 python,...</p>', truncator.words(3, '...', html=True))
141 151 142 -
re_tag_catastrophic_test = ('</a' + '\t' * 50000) + '//>'
143 -
truncator = text.Truncator(re_tag_catastrophic_test)
144 -
self.assertEqual(re_tag_catastrophic_test, truncator.words(500, html=True))
152 +
perf_test_values = [
153 +
('</a' + '\t' * 50000) + '//>',
154 +
'&' * 50000,
155 +
'_X<<<<<<<<<<<>',
156 +
]
157 +
for value in perf_test_values:
158 +
truncator = text.Truncator(value)
159 +
self.assertEqual(value, truncator.words(50, html=True))
145 160 146 161
def test_wrap(self):
147 162
digits = '1234 67 9'
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4