Commit 5447709a authored by Tim Graham's avatar Tim Graham
Browse files

[1.8.x] Fixed an infinite loop possibility in strip_tags(). 

This is a security fix; disclosure to follow shortly.
parent 5a8ef2a3

django/utils/html.py

+4 −2
Original line number Diff line number Diff line
@@ -183,8 +183,10 @@ def strip_tags(value): 
    # is redundant, but helps to reduce number of executions of _strip_once.

    while '<' in value and '>' in value:

        new_value = _strip_once(value)

        if new_value == value:

            # _strip_once was not able to detect more tags

        if len(new_value) >= len(value):

            # _strip_once was not able to detect more tags or length increased

            # due to http://bugs.python.org/issue20288

            # (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)

            break

        value = new_value

    return value

docs/releases/1.6.11.txt

+17 −0
Original line number Diff line number Diff line
@@ -5,3 +5,20 @@ Django 1.6.11 release notes 
*March 18, 2015*



Django 1.6.11 fixes two security issues in 1.6.10.



Denial-of-service possibility with ``strip_tags()``

===================================================



Last year :func:`~django.utils.html.strip_tags`  was changed to work

iteratively. The problem is that the size of the input it's processing can

increase on each iteration which results in an infinite loop in

``strip_tags()``. This issue only affects versions of Python that haven't

received  `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely

Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported

the fix for the Python bug into their packages of earlier versions.



To remedy this issue, ``strip_tags()`` will now return the original input if

it detects the length of the string it's processing increases. Remember that

absolutely NO guarantee is provided about the results of ``strip_tags()`` being

HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without

escaping it first, for example with :func:`~django.utils.html.escape`.

docs/releases/1.7.7.txt

+17 −0
Original line number Diff line number Diff line
@@ -6,6 +6,23 @@ Django 1.7.7 release notes 


Django 1.7.7 fixes several bugs and security issues in 1.7.6.



Denial-of-service possibility with ``strip_tags()``

===================================================



Last year :func:`~django.utils.html.strip_tags`  was changed to work

iteratively. The problem is that the size of the input it's processing can

increase on each iteration which results in an infinite loop in

``strip_tags()``. This issue only affects versions of Python that haven't

received  `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely

Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported

the fix for the Python bug into their packages of earlier versions.



To remedy this issue, ``strip_tags()`` will now return the original input if

it detects the length of the string it's processing increases. Remember that

absolutely NO guarantee is provided about the results of ``strip_tags()`` being

HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without

escaping it first, for example with :func:`~django.utils.html.escape`.



Bugfixes

========

tests/utils_tests/test_html.py

+3 −0
Original line number Diff line number Diff line
@@ -82,6 +82,9 @@ class TestUtilsHtml(TestCase): 
            ('a<p a >b</p>c', 'abc'),

            ('d<a:b c:d>e</p>f', 'def'),

            ('<strong>foo</strong><a href="http://example.com">bar</a>', 'foobar'),

            # caused infinite loop on Pythons not patched with

            # http://bugs.python.org/issue20288

            ('&gotcha&#;<>', '&gotcha&#;<>'),

        )

        for value, output in items:

            self.check_output(f, value, output)