diff options
author | Florian Apolloner <florian@apolloner.eu> | 2019-07-15 12:00:06 +0200 |
---|---|---|
committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-07-29 11:20:43 +0200 |
commit | 52479acce792ad80bb0f915f20b835f919993c72 (patch) | |
tree | e34bce6441d55e96c73e571d542d722bf077d3dd /docs/releases/1.11.23.txt | |
parent | 42a66e969023c00536256469f0e8b8a099ef109d (diff) | |
download | django-52479acce792ad80bb0f915f20b835f919993c72.tar.gz |
[1.11.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'docs/releases/1.11.23.txt')
-rw-r--r-- | docs/releases/1.11.23.txt | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/docs/releases/1.11.23.txt b/docs/releases/1.11.23.txt index 6058bb8a81..c95ffd9a50 100644 --- a/docs/releases/1.11.23.txt +++ b/docs/releases/1.11.23.txt @@ -19,3 +19,20 @@ filters, which were thus vulnerable. The regular expressions used by ``Truncator`` have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output. + +CVE-2019-14233: Denial-of-service possibility in ``strip_tags()`` +================================================================= + +Due to the behavior of the underlying ``HTMLParser``, +:func:`django.utils.html.strip_tags` would be extremely slow to evaluate +certain inputs containing large sequences of nested incomplete HTML entities. +The ``strip_tags()`` method is used to implement the corresponding +:tfilter:`striptags` template filter, which was thus also vulnerable. + +``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress +removing tags, but necessarily incomplete HTML entities, stops being made. + +Remember that absolutely NO guarantee is provided about the results of +``strip_tags()`` being HTML safe. So NEVER mark safe the result of a +``strip_tags()`` call without escaping it first, for example with +:func:`django.utils.html.escape`. |