From: Chris Lamb Date: Thu, 8 Aug 2019 10:31:08 +0100 Subject: CVE-2019-14233 Backported from --- django/utils/html.py | 4 ++-- tests/utils_tests/test_html.py | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/django/utils/html.py b/django/utils/html.py index 5a9f735..3fb791c 100644 --- a/django/utils/html.py +++ b/django/utils/html.py @@ -175,8 +175,8 @@ def strip_tags(value): value = force_text(value) while '<' in value and '>' in value: new_value = _strip_once(value) - if len(new_value) >= len(value): - # _strip_once was not able to detect more tags or length increased + if len(new_value) >= len(value) or value.count('<') == new_value.count('<'): + # _strip_once wasn't able to detect more tags, or line length increased. # due to http://bugs.python.org/issue20288 # (affects Python 2 < 2.7.7 and Python 3 < 3.3.5) break diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py index 8b683c1..56c380c 100644 --- a/tests/utils_tests/test_html.py +++ b/tests/utils_tests/test_html.py @@ -86,6 +86,8 @@ class TestUtilsHtml(SimpleTestCase): # caused infinite loop on Pythons not patched with # http://bugs.python.org/issue20288 ('&gotcha&#;<>', '&gotcha&#;<>'), + ('>br>br>br>X', 'XX'), ) for value, output in items: self.check_output(f, value, output)