Skip to content

Commit c23723a

Browse files
apollo13carltongibson
apollo13
authored and
carltongibson
committed
[2.1.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues when truncating HTML.
Thanks to Guido Vranken for initial report.
1 parent 24eba90 commit c23723a

5 files changed

Lines changed: 53 additions & 8 deletions

File tree

‎django/utils/text.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ def capfirst(x):
1818

1919

2020
# Set up regular expressions
21-
re_words = re.compile(r'<.*?>|((?:\w[-\w]*|&.*?;)+)', re.S)
22-
re_chars = re.compile(r'<.*?>|(.)', re.S)
21+
re_words = re.compile(r'<[^>]+?>|([^<>\s]+)', re.S)
22+
re_chars = re.compile(r'<[^>]+?>|(.)', re.S)
2323
re_tag = re.compile(r'<(/)?(\S+?)(?:(\s*/)|\s.*?)?>', re.S)
2424
re_newlines = re.compile(r'\r\n|\r') # Used in normalize_newlines
2525
re_camel_case = re.compile(r'(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')

‎docs/releases/1.11.23.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,17 @@ Django 1.11.23 release notes
55
*August 1, 2019*
66

77
Django 1.11.23 fixes security issues in 1.11.22.
8+
9+
CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``
10+
================================================================================
11+
12+
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods
13+
were passed the ``html=True`` argument, they were extremely slow to evaluate
14+
certain inputs due to a catastrophic backtracking vulnerability in a regular
15+
expression. The ``chars()`` and ``words()`` methods are used to implement the
16+
:tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template
17+
filters, which were thus vulnerable.
18+
19+
The regular expressions used by ``Truncator`` have been simplified in order to
20+
avoid potential backtracking issues. As a consequence, trailing punctuation may
21+
now at times be included in the truncated output.

‎docs/releases/2.1.11.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,17 @@ Django 2.1.11 release notes
55
*August 1, 2019*
66

77
Django 2.1.11 fixes security issues in 2.1.10.
8+
9+
CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``
10+
================================================================================
11+
12+
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods
13+
were passed the ``html=True`` argument, they were extremely slow to evaluate
14+
certain inputs due to a catastrophic backtracking vulnerability in a regular
15+
expression. The ``chars()`` and ``words()`` methods are used to implement the
16+
:tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template
17+
filters, which were thus vulnerable.
18+
19+
The regular expressions used by ``Truncator`` have been simplified in order to
20+
avoid potential backtracking issues. As a consequence, trailing punctuation may
21+
now at times be included in the truncated output.

‎tests/template_tests/filter_tests/test_truncatewords_html.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ def test_truncate(self):
1616
def test_truncate2(self):
1717
self.assertEqual(
1818
truncatewords_html('<p>one <a href="#">two - three <br>four</a> five</p>', 4),
19-
'<p>one <a href="#">two - three <br>four ...</a></p>',
19+
'<p>one <a href="#">two - three ...</a></p>',
2020
)
2121

2222
def test_truncate3(self):
2323
self.assertEqual(
2424
truncatewords_html('<p>one <a href="#">two - three <br>four</a> five</p>', 5),
25-
'<p>one <a href="#">two - three <br>four</a> five</p>',
25+
'<p>one <a href="#">two - three <br>four ...</a></p>',
2626
)
2727

2828
def test_truncate4(self):

‎tests/utils_tests/test_text.py‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,17 @@ def test_truncate_chars(self):
8585
# lazy strings are handled correctly
8686
self.assertEqual(text.Truncator(lazystr('The quick brown fox')).chars(12), 'The quick...')
8787

88+
def test_truncate_chars_html(self):
89+
perf_test_values = [
90+
(('</a' + '\t' * 50000) + '//>', None),
91+
('&' * 50000, '&' * 7 + '...'),
92+
('_X<<<<<<<<<<<>', None),
93+
]
94+
for value, expected in perf_test_values:
95+
with self.subTest(value=value):
96+
truncator = text.Truncator(value)
97+
self.assertEqual(expected if expected else value, truncator.chars(10, html=True))
98+
8899
def test_truncate_words(self):
89100
truncator = text.Truncator('The quick brown fox jumped over the lazy dog.')
90101
self.assertEqual('The quick brown fox jumped over the lazy dog.', truncator.words(10))
@@ -134,11 +145,17 @@ def test_truncate_html_words(self):
134145
truncator = text.Truncator('<i>Buenos d&iacute;as! &#x00bf;C&oacute;mo est&aacute;?</i>')
135146
self.assertEqual('<i>Buenos d&iacute;as! &#x00bf;C&oacute;mo...</i>', truncator.words(3, '...', html=True))
136147
truncator = text.Truncator('<p>I &lt;3 python, what about you?</p>')
137-
self.assertEqual('<p>I &lt;3 python...</p>', truncator.words(3, '...', html=True))
148+
self.assertEqual('<p>I &lt;3 python,...</p>', truncator.words(3, '...', html=True))
138149

139-
re_tag_catastrophic_test = ('</a' + '\t' * 50000) + '//>'
140-
truncator = text.Truncator(re_tag_catastrophic_test)
141-
self.assertEqual(re_tag_catastrophic_test, truncator.words(500, html=True))
150+
perf_test_values = [
151+
('</a' + '\t' * 50000) + '//>',
152+
'&' * 50000,
153+
'_X<<<<<<<<<<<>',
154+
]
155+
for value in perf_test_values:
156+
with self.subTest(value=value):
157+
truncator = text.Truncator(value)
158+
self.assertEqual(value, truncator.words(50, html=True))
142159

143160
def test_wrap(self):
144161
digits = '1234 67 9'

0 commit comments

Comments
 (0)