Permalink
Browse files

[1.7.x] Fixed an infinite loop possibility in strip_tags().

This is a security fix; disclosure to follow shortly.
  • Loading branch information...
timgraham committed Mar 4, 2015
1 parent 26fd726 commit e63363f8e075fa8d66326ad6a1cc3391cc95cd97
Showing with 41 additions and 2 deletions.
  1. +4 −2 django/utils/html.py
  2. +17 −0 docs/releases/1.6.11.txt
  3. +17 −0 docs/releases/1.7.7.txt
  4. +3 −0 tests/utils_tests/test_html.py
View
@@ -173,8 +173,10 @@ def strip_tags(value):
# is redundant, but helps to reduce number of executions of _strip_once.
while '<' in value and '>' in value:
new_value = _strip_once(value)
if new_value == value:
# _strip_once was not able to detect more tags
if len(new_value) >= len(value):
# _strip_once was not able to detect more tags or length increased
# due to http://bugs.python.org/issue20288
# (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)
break
value = new_value
return value
View
@@ -5,3 +5,20 @@ Django 1.6.11 release notes
*March 18, 2015*
Django 1.6.11 fixes two security issues in 1.6.10.
Denial-of-service possibility with ``strip_tags()``
===================================================
Last year :func:`~django.utils.html.strip_tags` was changed to work
iteratively. The problem is that the size of the input it's processing can
increase on each iteration which results in an infinite loop in
``strip_tags()``. This issue only affects versions of Python that haven't
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
the fix for the Python bug into their packages of earlier versions.
To remedy this issue, ``strip_tags()`` will now return the original input if
it detects the length of the string it's processing increases. Remember that
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
escaping it first, for example with :func:`~django.utils.html.escape`.
View
@@ -6,6 +6,23 @@ Django 1.7.7 release notes
Django 1.7.7 fixes several bugs and security issues in 1.7.6.
Denial-of-service possibility with ``strip_tags()``
===================================================
Last year :func:`~django.utils.html.strip_tags` was changed to work
iteratively. The problem is that the size of the input it's processing can
increase on each iteration which results in an infinite loop in
``strip_tags()``. This issue only affects versions of Python that haven't
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
the fix for the Python bug into their packages of earlier versions.
To remedy this issue, ``strip_tags()`` will now return the original input if
it detects the length of the string it's processing increases. Remember that
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
escaping it first, for example with :func:`~django.utils.html.escape`.
Bugfixes
========
@@ -82,6 +82,9 @@ def test_strip_tags(self):
('a<p a >b</p>c', 'abc'),
('d<a:b c:d>e</p>f', 'def'),
('<strong>foo</strong><a href="http://example.com">bar</a>', 'foobar'),
# caused infinite loop on Pythons not patched with
# http://bugs.python.org/issue20288
('&gotcha&#;<>', '&gotcha&#;<>'),
)
for value, output in items:
self.check_output(f, value, output)

0 comments on commit e63363f

Please sign in to comment.