1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
From: Chris Lamb <lamby@debian.org>
Date: Thu, 8 Aug 2019 10:31:08 +0100
Subject: CVE-2019-14233
Backported from
<https://github.com/django/django/commit/52479acce792ad80bb0f915f20b835f919993c72>
---
django/utils/html.py | 4 ++--
tests/utils_tests/test_html.py | 2 ++
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/django/utils/html.py b/django/utils/html.py
index 5a9f735..3fb791c 100644
--- a/django/utils/html.py
+++ b/django/utils/html.py
@@ -175,8 +175,8 @@ def strip_tags(value):
value = force_text(value)
while '<' in value and '>' in value:
new_value = _strip_once(value)
- if len(new_value) >= len(value):
- # _strip_once was not able to detect more tags or length increased
+ if len(new_value) >= len(value) or value.count('<') == new_value.count('<'):
+ # _strip_once wasn't able to detect more tags, or line length increased.
# due to http://bugs.python.org/issue20288
# (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)
break
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
index 8b683c1..56c380c 100644
--- a/tests/utils_tests/test_html.py
+++ b/tests/utils_tests/test_html.py
@@ -86,6 +86,8 @@ class TestUtilsHtml(SimpleTestCase):
# caused infinite loop on Pythons not patched with
# http://bugs.python.org/issue20288
('&gotcha&#;<>', '&gotcha&#;<>'),
+ ('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),
+ ('X<<<<br>br>br>br>X', 'XX'),
)
for value, output in items:
self.check_output(f, value, output)
|
