Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Please login to access the resource
SUSE:SLE-15-SP1:Update
python-Django.34948
CVE-2024-39614.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2024-39614.patch of Package python-Django.34948
From 40ff5da3600a05dfdbc2a90b197771741a1aede4 Mon Sep 17 00:00:00 2001 From: nkrapp <nico.krapp@suse.com> Date: Fri, 26 Jul 2024 15:26:07 +0200 Subject: [PATCH] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant(). --- django/utils/translation/trans_real.py | 29 ++++++++++--- docs/ref/utils.txt | 25 +++++++++++ tests/i18n/tests.py | 59 ++++++++++++++++++++++++++ 3 files changed, 107 insertions(+), 6 deletions(-) diff --git a/django/utils/translation/trans_real.py b/django/utils/translation/trans_real.py index f363344392..44ccbf67f1 100644 --- a/django/utils/translation/trans_real.py +++ b/django/utils/translation/trans_real.py @@ -29,9 +29,10 @@ _default = None CONTEXT_SEPARATOR = "\x04" # Maximum number of characters that will be parsed from the Accept-Language -# header to prevent possible denial of service or memory exhaustion attacks. -# About 10x longer than the longest value shown on MDN’s Accept-Language page. -ACCEPT_LANGUAGE_HEADER_MAX_LENGTH = 500 +# header or cookie to prevent possible denial of service or memory exhaustion +# attacks. About 10x longer than the longest value shown on MDN’s +# Accept-Language page. +LANGUAGE_CODE_MAX_LENGTH = 500 # Format of Accept-Language header values. From RFC 2616, section 14.4 and 3.9 # and RFC 3066, section 2.1 @@ -422,12 +423,28 @@ def get_supported_language_variant(lang_code, strict=False): If `strict` is False (the default), look for an alternative country-specific variant when the currently checked is not found. + The language code is truncated to a maximum length to avoid potential + denial of service attacks. + lru_cache should have a maxsize to prevent from memory exhaustion attacks, as the provided language codes are taken from the HTTP request. See also <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>. """ if lang_code: - # If 'fr-ca' is not supported, try special fallback or language-only 'fr'. + # Truncate the language code to a maximum length to avoid potential + # denial of service attacks. + if len(lang_code) > LANGUAGE_CODE_MAX_LENGTH: + index = lang_code.rfind("-", 0, LANGUAGE_CODE_MAX_LENGTH) + if ( + not strict + and index > 0 + ): + # There is a generic variant under the maximum length accepted length. + lang_code = lang_code[:index] + else: + raise ValueError("'lang_code' exceeds the maximum accepted length") + # If 'zh-hant-tw' is not supported, try special fallback or subsequent + # language codes i.e. 'zh-hant' and 'zh'. possible_lang_codes = [lang_code] try: possible_lang_codes.extend(LANG_INFO[lang_code]['fallback']) @@ -549,13 +566,13 @@ def parse_accept_lang_header(lang_string): functools.lru_cache() to avoid repetitive parsing of common header values. """ # If the header value doesn't exceed the maximum allowed length, parse it. - if len(lang_string) <= ACCEPT_LANGUAGE_HEADER_MAX_LENGTH: + if len(lang_string) <= LANGUAGE_CODE_MAX_LENGTH: return _parse_accept_lang_header(lang_string) # If there is at least one comma in the value, parse up to the last comma # before the max length, skipping any truncated parts at the end of the # header value. - index = lang_string.rfind(",", 0, ACCEPT_LANGUAGE_HEADER_MAX_LENGTH) + index = lang_string.rfind(",", 0, LANGUAGE_CODE_MAX_LENGTH) if index > 0: return _parse_accept_lang_header(lang_string[:index]) diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt index 9410202587..b89eb8011f 100644 --- a/docs/ref/utils.txt +++ b/docs/ref/utils.txt @@ -1126,6 +1126,31 @@ functions without the ``u``. for whether its path begins with a language code listed in the :setting:`LANGUAGES` setting. +.. function:: get_supported_language_variant(lang_code, strict=False) + + Returns ``lang_code`` if it's in the :setting:`LANGUAGES` setting, possibly + selecting a more generic variant. For example, ``'es'`` is returned if + ``lang_code`` is ``'es-ar'`` and ``'es'`` is in :setting:`LANGUAGES` but + ``'es-ar'`` isn't. + + ``lang_code`` has a maximum accepted length of 500 characters. A + :exc:`ValueError` is raised if ``lang_code`` exceeds this limit and + ``strict`` is ``True``, or if there is no generic variant and ``strict`` + is ``False``. + + If ``strict`` is ``False`` (the default), a country-specific variant may + be returned when neither the language code nor its generic variant is found. + For example, if only ``'es-co'`` is in :setting:`LANGUAGES`, that's + returned for ``lang_code``\s like ``'es'`` and ``'es-ar'``. Those matches + aren't returned if ``strict=True``. + + Raises :exc:`LookupError` if nothing is found. + + .. versionchanged:: 4.2.14 + + In older versions, ``lang_code`` values over 500 characters were + processed without raising a :exc:`ValueError`. + .. function:: to_locale(language) Turns a language name (en-us) into a locale name (en_US). diff --git a/tests/i18n/tests.py b/tests/i18n/tests.py index e858a021c2..0fd05b0976 100644 --- a/tests/i18n/tests.py +++ b/tests/i18n/tests.py @@ -32,6 +32,7 @@ from django.utils.translation import ( npgettext, npgettext_lazy, pgettext, string_concat, to_locale, trans_real, ugettext, ugettext_lazy, ungettext, ungettext_lazy, ) +from django.utils.translation.trans_real import LANGUAGE_CODE_MAX_LENGTH from .forms import CompanyForm, I18nForm, SelectDateForm from .models import Company, TestModel @@ -1305,6 +1306,64 @@ class MiscTests(SimpleTestCase): r.COOKIES = {settings.LANGUAGE_COOKIE_NAME: 'zh-hans'} r.META = {'HTTP_ACCEPT_LANGUAGE': 'de'} self.assertEqual(g(r), 'zh-hans') + + @override_settings( + USE_I18N=True, + LANGUAGES=[ + ("en", "English"), + ("ar-dz", "Algerian Arabic"), + ("de", "German"), + ("de-at", "Austrian German"), + ("pt-BR", "Portuguese (Brazil)"), + ], + ) + def test_get_supported_language_variant_real(self): + g = trans_real.get_supported_language_variant + self.assertEqual(g("en"), "en") + self.assertEqual(g("en-gb"), "en") + self.assertEqual(g("de"), "de") + self.assertEqual(g("de-at"), "de-at") + self.assertEqual(g("de-ch"), "de") + self.assertEqual(g("pt-br"), "pt-br") + self.assertEqual(g("pt-BR"), "pt-BR") + self.assertEqual(g("pt"), "pt-br") + self.assertEqual(g("pt-pt"), "pt-br") + self.assertEqual(g("ar-dz"), "ar-dz") + self.assertEqual(g("ar-DZ"), "ar-DZ") + with self.assertRaises(LookupError): + g("pt", strict=True) + with self.assertRaises(LookupError): + g("pt-pt", strict=True) + with self.assertRaises(LookupError): + g("xyz") + with self.assertRaises(LookupError): + g("xy-zz") + msg = "'lang_code' exceeds the maximum accepted length" + with self.assertRaises(LookupError): + g("x" * LANGUAGE_CODE_MAX_LENGTH) + with self.assertRaisesMessage(ValueError, msg): + g("x" * (LANGUAGE_CODE_MAX_LENGTH + 1)) + # 167 * 3 = 501 which is LANGUAGE_CODE_MAX_LENGTH + 1. + self.assertEqual(g("en-" * 167), "en") + with self.assertRaisesMessage(ValueError, msg): + g("en-" * 167, strict=True) + self.assertEqual(g("en-" * 30000), "en") # catastrophic test + + def test_get_supported_language_variant_null(self): + g = trans_null.get_supported_language_variant + self.assertEqual(g(settings.LANGUAGE_CODE), settings.LANGUAGE_CODE) + with self.assertRaises(LookupError): + g("pt") + with self.assertRaises(LookupError): + g("de") + with self.assertRaises(LookupError): + g("de-at") + with self.assertRaises(LookupError): + g("de", strict=True) + with self.assertRaises(LookupError): + g("de-at", strict=True) + with self.assertRaises(LookupError): + g("xyz") @override_settings( LANGUAGES=[ -- 2.45.2
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
