Эх сурвалжийг харах

HUE-4777 [backend] Fixing The utils.html.strip_tags function in Django can cause a denial of service

Prakash Ranade 9 жил өмнө
parent
commit
90f3063

+ 10 - 9
desktop/core/ext-py/Django-1.6.10/django/utils/html.py

@@ -149,18 +149,19 @@ def _strip_once(value):
     else:
         return s.get_data()
 
-
 def strip_tags(value):
     """Returns the given HTML with all tags stripped."""
-    while True:
-        if not ('<' in value or '>' in value):
-            return value
+    # Note: in typical case this loop executes _strip_once once. Loop condition
+    # is redundant, but helps to reduce number of executions of _strip_once.
+    while '<' in value and '>' in value:
         new_value = _strip_once(value)
-        if new_value == value:
-            # _strip_once was not able to detect more tags
-            return value
-        else:
-            value = new_value
+        if len(new_value) >= len(value):
+            # _strip_once was not able to detect more tags or length increased
+            # due to http://bugs.python.org/issue20288
+            # (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)
+            break
+        value = new_value
+    return value
 strip_tags = allow_lazy(strip_tags)
 
 def remove_tags(html, tags):

+ 3 - 0
desktop/core/ext-py/Django-1.6.10/tests/utils_tests/test_html.py

@@ -80,6 +80,9 @@ class TestUtilsHtml(TestCase):
             ('a<p a >b</p>c', 'abc'),
             ('d<a:b c:d>e</p>f', 'def'),
             ('<strong>foo</strong><a href="http://example.com">bar</a>', 'foobar'),
+            # caused infinite loop on Pythons not patched with
+            # http://bugs.python.org/issue20288
+            ('&gotcha&#;<>', '&gotcha&#;<>'),
         )
         for value, output in items:
             self.check_output(f, value, output)