+41
-2
lines changedFilter options
+41
-2
lines changed Original file line number Diff line number Diff line change
@@ -183,8 +183,10 @@ def strip_tags(value):
183 183
# is redundant, but helps to reduce number of executions of _strip_once.
184 184
while '<' in value and '>' in value:
185 185
new_value = _strip_once(value)
186 -
if new_value == value:
187 -
# _strip_once was not able to detect more tags
186 +
if len(new_value) >= len(value):
187 +
# _strip_once was not able to detect more tags or length increased
188 +
# due to http://bugs.python.org/issue20288
189 +
# (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)
188 190
break
189 191
value = new_value
190 192
return value
@@ -5,3 +5,20 @@ Django 1.6.11 release notes
5 5
*March 18, 2015*
6 6 7 7
Django 1.6.11 fixes two security issues in 1.6.10.
8 + 9 +
Denial-of-service possibility with ``strip_tags()``
10 +
===================================================
11 + 12 +
Last year :func:`~django.utils.html.strip_tags` was changed to work
13 +
iteratively. The problem is that the size of the input it's processing can
14 +
increase on each iteration which results in an infinite loop in
15 +
``strip_tags()``. This issue only affects versions of Python that haven't
16 +
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
17 +
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
18 +
the fix for the Python bug into their packages of earlier versions.
19 + 20 +
To remedy this issue, ``strip_tags()`` will now return the original input if
21 +
it detects the length of the string it's processing increases. Remember that
22 +
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
23 +
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
24 +
escaping it first, for example with :func:`~django.utils.html.escape`.
Original file line number Diff line number Diff line change
@@ -6,6 +6,23 @@ Django 1.7.7 release notes
6 6 7 7
Django 1.7.7 fixes several bugs and security issues in 1.7.6.
8 8 9 +
Denial-of-service possibility with ``strip_tags()``
10 +
===================================================
11 + 12 +
Last year :func:`~django.utils.html.strip_tags` was changed to work
13 +
iteratively. The problem is that the size of the input it's processing can
14 +
increase on each iteration which results in an infinite loop in
15 +
``strip_tags()``. This issue only affects versions of Python that haven't
16 +
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
17 +
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
18 +
the fix for the Python bug into their packages of earlier versions.
19 + 20 +
To remedy this issue, ``strip_tags()`` will now return the original input if
21 +
it detects the length of the string it's processing increases. Remember that
22 +
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
23 +
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
24 +
escaping it first, for example with :func:`~django.utils.html.escape`.
25 + 9 26
Bugfixes
10 27
========
11 28
@@ -82,6 +82,9 @@ def test_strip_tags(self):
82 82
('a<p a >b</p>c', 'abc'),
83 83
('d<a:b c:d>e</p>f', 'def'),
84 84
('<strong>foo</strong><a href="http://example.com">bar</a>', 'foobar'),
85 +
# caused infinite loop on Pythons not patched with
86 +
# http://bugs.python.org/issue20288
87 +
('&gotcha&#;<>', '&gotcha&#;<>'),
85 88
)
86 89
for value, output in items:
87 90
self.check_output(f, value, output)
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4