99 lines
4.4 KiB
Diff
99 lines
4.4 KiB
Diff
From 772a73f70c3d249c99c23012849e66276b7b0715 Mon Sep 17 00:00:00 2001
|
|
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
|
|
Date: Wed, 10 Jul 2024 20:30:12 +0200
|
|
Subject: [PATCH 3/4] [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS
|
|
in django.utils.html.urlize() and AdminURLFieldWidget.
|
|
|
|
Thanks Seokchan Yoon for the report.
|
|
|
|
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
---
|
|
django/contrib/admin/widgets.py | 2 +-
|
|
django/utils/html.py | 10 ++++++++--
|
|
tests/admin_widgets/tests.py | 7 ++++++-
|
|
tests/utils_tests/test_html.py | 13 +++++++++++++
|
|
5 files changed, 35 insertions(+), 4 deletions(-)
|
|
|
|
Index: Django-2.2.28/django/contrib/admin/widgets.py
|
|
===================================================================
|
|
--- Django-2.2.28.orig/django/contrib/admin/widgets.py
|
|
+++ Django-2.2.28/django/contrib/admin/widgets.py
|
|
@@ -344,7 +344,7 @@ class AdminURLFieldWidget(forms.URLInput
|
|
context = super().get_context(name, value, attrs)
|
|
context['current_label'] = _('Currently:')
|
|
context['change_label'] = _('Change:')
|
|
- context['widget']['href'] = smart_urlquote(context['widget']['value']) if value else ''
|
|
+ context['widget']['href'] = smart_urlquote(context['widget']['value']) if url_valid else ''
|
|
context['url_valid'] = url_valid
|
|
return context
|
|
|
|
Index: Django-2.2.28/django/utils/html.py
|
|
===================================================================
|
|
--- Django-2.2.28.orig/django/utils/html.py
|
|
+++ Django-2.2.28/django/utils/html.py
|
|
@@ -33,6 +33,8 @@ _html_escapes = {
|
|
ord("'"): ''',
|
|
}
|
|
|
|
+MAX_URL_LENGTH = 2048
|
|
+
|
|
|
|
@keep_lazy(str, SafeText)
|
|
def escape(text):
|
|
@@ -360,6 +362,10 @@ def urlize(text, trim_url_limit=None, no
|
|
except ValueError:
|
|
# value contains more than one @.
|
|
return False
|
|
+ # Max length for domain name labels is 63 characters per RFC 1034.
|
|
+ # Helps to avoid ReDoS vectors in the domain part.
|
|
+ if len(p2) > 63:
|
|
+ return False
|
|
# Dot must be in p2 (e.g. example.com)
|
|
if '.' not in p2 or p2.startswith('.'):
|
|
return False
|
|
@@ -378,9 +384,9 @@ def urlize(text, trim_url_limit=None, no
|
|
# Make URL we want to point to.
|
|
url = None
|
|
nofollow_attr = ' rel="nofollow"' if nofollow else ''
|
|
- if simple_url_re.match(middle):
|
|
+ if len(middle) <= MAX_URL_LENGTH and simple_url_re.match(middle):
|
|
url = smart_urlquote(unescape(middle))
|
|
- elif simple_url_2_re.match(middle):
|
|
+ elif len(middle) <= MAX_URL_LENGTH and simple_url_2_re.match(middle):
|
|
url = smart_urlquote('http://%s' % unescape(middle))
|
|
elif ':' not in middle and is_email_simple(middle):
|
|
local, domain = middle.rsplit('@', 1)
|
|
Index: Django-2.2.28/tests/admin_widgets/tests.py
|
|
===================================================================
|
|
--- Django-2.2.28.orig/tests/admin_widgets/tests.py
|
|
+++ Django-2.2.28/tests/admin_widgets/tests.py
|
|
@@ -336,7 +336,12 @@ class AdminSplitDateTimeWidgetTest(Simpl
|
|
class AdminURLWidgetTest(SimpleTestCase):
|
|
def test_get_context_validates_url(self):
|
|
w = widgets.AdminURLFieldWidget()
|
|
- for invalid in ['', '/not/a/full/url/', 'javascript:alert("Danger XSS!")']:
|
|
+ for invalid in [
|
|
+ "",
|
|
+ "/not/a/full/url/",
|
|
+ 'javascript:alert("Danger XSS!")',
|
|
+ "http://" + "한.글." * 1_000_000 + "com",
|
|
+ ]:
|
|
with self.subTest(url=invalid):
|
|
self.assertFalse(w.get_context('name', invalid, {})['url_valid'])
|
|
self.assertTrue(w.get_context('name', 'http://example.com', {})['url_valid'])
|
|
Index: Django-2.2.28/tests/utils_tests/test_html.py
|
|
===================================================================
|
|
--- Django-2.2.28.orig/tests/utils_tests/test_html.py
|
|
+++ Django-2.2.28/tests/utils_tests/test_html.py
|
|
@@ -261,6 +261,10 @@ class TestUtilsHtml(SimpleTestCase):
|
|
def test_urlize_unchanged_inputs(self):
|
|
tests = (
|
|
("a" + "@a" * 50000) + "a", # simple_email_re catastrophic test
|
|
+ # Unicode domain catastrophic tests.
|
|
+ "a@" + "한.글." * 1_000_000 + "a",
|
|
+ "http://" + "한.글." * 1_000_000 + "com",
|
|
+ "www." + "한.글." * 1_000_000 + "com",
|
|
("a" + "." * 1000000) + "a", # trailing_punctuation catastrophic test
|
|
"foo@",
|
|
"@foo.com",
|