+50
-8
lines changedFilter options
+50
-8
lines changed Original file line number Diff line number Diff line change
@@ -395,14 +395,17 @@ def trim_punctuation(self, word):
395 395
potential_entity = middle[amp:]
396 396
escaped = html.unescape(potential_entity)
397 397
if escaped == potential_entity or escaped.endswith(";"):
398 -
rstripped = middle.rstrip(";")
399 -
amount_stripped = len(middle) - len(rstripped)
400 -
if amp > -1 and amount_stripped > 1:
401 -
# Leave a trailing semicolon as might be an entity.
402 -
trail = middle[len(rstripped) + 1 :] + trail
403 -
middle = rstripped + ";"
398 +
rstripped = middle.rstrip(self.trailing_punctuation_chars)
399 +
trail_start = len(rstripped)
400 +
amount_trailing_semicolons = len(middle) - len(middle.rstrip(";"))
401 +
if amp > -1 and amount_trailing_semicolons > 1:
402 +
# Leave up to most recent semicolon as might be an entity.
403 +
recent_semicolon = middle[trail_start:].index(";")
404 +
middle_semicolon_index = recent_semicolon + trail_start + 1
405 +
trail = middle[middle_semicolon_index:] + trail
406 +
middle = rstripped + middle[trail_start:middle_semicolon_index]
404 407
else:
405 -
trail = middle[len(rstripped) :] + trail
408 +
trail = middle[trail_start:] + trail
406 409
middle = rstripped
407 410
trimmed_something = True
408 411
@@ -2831,6 +2831,17 @@ Django's built-in :tfilter:`escape` filter. The default value for
2831 2831
email addresses that contain single quotes (``'``), things won't work as
2832 2832
expected. Apply this filter only to plain text.
2833 2833 2834 +
.. warning::
2835 + 2836 +
Using ``urlize`` or ``urlizetrunc`` can incur a performance penalty, which
2837 +
can become severe when applied to user controlled values such as content
2838 +
stored in a :class:`~django.db.models.TextField`. You can use
2839 +
:tfilter:`truncatechars` to add a limit to such inputs:
2840 + 2841 +
.. code-block:: html+django
2842 + 2843 +
{{ value|truncatechars:500|urlize }}
2844 + 2834 2845
.. templatefilter:: urlizetrunc
2835 2846 2836 2847
``urlizetrunc``
@@ -7,4 +7,9 @@ Django 4.2.16 release notes
7 7
Django 4.2.16 fixes one security issue with severity "moderate" and one
8 8
security issue with severity "low" in 4.2.15.
9 9 10 -
...
10 +
CVE-2024-45230: Potential denial-of-service vulnerability in ``django.utils.html.urlize()``
11 +
===========================================================================================
12 + 13 +
:tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential
14 +
denial-of-service attack via very large inputs with a specific sequence of
15 +
characters.
Original file line number Diff line number Diff line change
@@ -305,6 +305,28 @@ def test_trailing_multiple_punctuation(self):
305 305
"http://testing.com/example</a>.,:;)"!",
306 306
)
307 307 308 +
def test_trailing_semicolon(self):
309 +
self.assertEqual(
310 +
urlize("http://example.com?x=&", autoescape=False),
311 +
'<a href="http://example.com?x=" rel="nofollow">'
312 +
"http://example.com?x=&</a>",
313 +
)
314 +
self.assertEqual(
315 +
urlize("http://example.com?x=&;", autoescape=False),
316 +
'<a href="http://example.com?x=" rel="nofollow">'
317 +
"http://example.com?x=&</a>;",
318 +
)
319 +
self.assertEqual(
320 +
urlize("http://example.com?x=&;;", autoescape=False),
321 +
'<a href="http://example.com?x=" rel="nofollow">'
322 +
"http://example.com?x=&</a>;;",
323 +
)
324 +
self.assertEqual(
325 +
urlize("http://example.com?x=&.;...;", autoescape=False),
326 +
'<a href="http://example.com?x=" rel="nofollow">'
327 +
"http://example.com?x=&</a>.;...;",
328 +
)
329 + 308 330
def test_brackets(self):
309 331
"""
310 332
#19070 - Check urlize handles brackets properly
@@ -364,6 +364,7 @@ def test_urlize_unchanged_inputs(self):
364 364
"&:" + ";" * 100_000,
365 365
"&.;" * 100_000,
366 366
".;" * 100_000,
367 +
"&" + ";:" * 100_000,
367 368
)
368 369
for value in tests:
369 370
with self.subTest(value=value):
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4