File CVE-2024-39614.patch of Package python-Django.35578

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2024-39614.patch of Package python-Django.35578

From 40ff5da3600a05dfdbc2a90b197771741a1aede4 Mon Sep 17 00:00:00 2001
From: nkrapp <nico.krapp@suse.com>
Date: Fri, 26 Jul 2024 15:26:07 +0200
Subject: [PATCH] Fixed CVE-2024-39614 -- Mitigated potential DoS in 
 get_supported_language_variant().

---
 django/utils/translation/trans_real.py | 29 ++++++++++---
 docs/ref/utils.txt                     | 25 +++++++++++
 tests/i18n/tests.py                    | 59 ++++++++++++++++++++++++++
 3 files changed, 107 insertions(+), 6 deletions(-)

diff --git a/django/utils/translation/trans_real.py b/django/utils/translation/trans_real.py
index f363344392..44ccbf67f1 100644
--- a/django/utils/translation/trans_real.py
+++ b/django/utils/translation/trans_real.py
@@ -29,9 +29,10 @@ _default = None
 CONTEXT_SEPARATOR = "\x04"
 
 # Maximum number of characters that will be parsed from the Accept-Language
-# header to prevent possible denial of service or memory exhaustion attacks.
-# About 10x longer than the longest value shown on MDN’s Accept-Language page.
-ACCEPT_LANGUAGE_HEADER_MAX_LENGTH = 500
+# header or cookie to prevent possible denial of service or memory exhaustion
+# attacks. About 10x longer than the longest value shown on MDN’s
+# Accept-Language page.
+LANGUAGE_CODE_MAX_LENGTH = 500
 
 # Format of Accept-Language header values. From RFC 2616, section 14.4 and 3.9
 # and RFC 3066, section 2.1
@@ -422,12 +423,28 @@ def get_supported_language_variant(lang_code, strict=False):
     If `strict` is False (the default), look for an alternative
     country-specific variant when the currently checked is not found.
 
+    The language code is truncated to a maximum length to avoid potential
+    denial of service attacks.
+
     lru_cache should have a maxsize to prevent from memory exhaustion attacks,
     as the provided language codes are taken from the HTTP request. See also
     <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>.
     """
     if lang_code:
-        # If 'fr-ca' is not supported, try special fallback or language-only 'fr'.
+        # Truncate the language code to a maximum length to avoid potential
+        # denial of service attacks.
+        if len(lang_code) > LANGUAGE_CODE_MAX_LENGTH:
+            index = lang_code.rfind("-", 0, LANGUAGE_CODE_MAX_LENGTH)
+            if (
+                not strict
+                and index > 0
+            ):
+                # There is a generic variant under the maximum length accepted length.
+                lang_code = lang_code[:index]
+            else:
+                raise ValueError("'lang_code' exceeds the maximum accepted length")
+        # If 'zh-hant-tw' is not supported, try special fallback or subsequent
+        # language codes i.e. 'zh-hant' and 'zh'.
         possible_lang_codes = [lang_code]
         try:
             possible_lang_codes.extend(LANG_INFO[lang_code]['fallback'])
@@ -549,13 +566,13 @@ def parse_accept_lang_header(lang_string):
     functools.lru_cache() to avoid repetitive parsing of common header values.
     """
     # If the header value doesn't exceed the maximum allowed length, parse it.
-    if len(lang_string) <= ACCEPT_LANGUAGE_HEADER_MAX_LENGTH:
+    if len(lang_string) <= LANGUAGE_CODE_MAX_LENGTH:
         return _parse_accept_lang_header(lang_string)
 
     # If there is at least one comma in the value, parse up to the last comma
     # before the max length, skipping any truncated parts at the end of the
     # header value.
-    index = lang_string.rfind(",", 0, ACCEPT_LANGUAGE_HEADER_MAX_LENGTH)
+    index = lang_string.rfind(",", 0, LANGUAGE_CODE_MAX_LENGTH)
     if index > 0:
         return _parse_accept_lang_header(lang_string[:index])
 
diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt
index 9410202587..b89eb8011f 100644
--- a/docs/ref/utils.txt
+++ b/docs/ref/utils.txt
@@ -1126,6 +1126,31 @@ functions without the ``u``.
     for whether its path begins with a language code listed in the
     :setting:`LANGUAGES` setting.
 
+.. function:: get_supported_language_variant(lang_code, strict=False)
+
+    Returns ``lang_code`` if it's in the :setting:`LANGUAGES` setting, possibly
+    selecting a more generic variant. For example, ``'es'`` is returned if
+    ``lang_code`` is ``'es-ar'`` and ``'es'`` is in :setting:`LANGUAGES` but
+    ``'es-ar'`` isn't.
+
+    ``lang_code`` has a maximum accepted length of 500 characters. A
+    :exc:`ValueError` is raised if ``lang_code`` exceeds this limit and
+    ``strict`` is ``True``, or if there is no generic variant and ``strict``
+    is ``False``.
+
+    If ``strict`` is ``False`` (the default), a country-specific variant may
+    be returned when neither the language code nor its generic variant is found.
+    For example, if only ``'es-co'`` is in :setting:`LANGUAGES`, that's
+    returned for ``lang_code``\s like ``'es'`` and ``'es-ar'``. Those matches
+    aren't returned if ``strict=True``.
+
+    Raises :exc:`LookupError` if nothing is found.
+
+    .. versionchanged:: 4.2.14
+
+        In older versions, ``lang_code`` values over 500 characters were
+        processed without raising a :exc:`ValueError`.
+
 .. function:: to_locale(language)
 
     Turns a language name (en-us) into a locale name (en_US).
diff --git a/tests/i18n/tests.py b/tests/i18n/tests.py
index e858a021c2..0fd05b0976 100644
--- a/tests/i18n/tests.py
+++ b/tests/i18n/tests.py
@@ -32,6 +32,7 @@ from django.utils.translation import (
     npgettext, npgettext_lazy, pgettext, string_concat, to_locale, trans_real,
     ugettext, ugettext_lazy, ungettext, ungettext_lazy,
 )
+from django.utils.translation.trans_real import LANGUAGE_CODE_MAX_LENGTH
 
 from .forms import CompanyForm, I18nForm, SelectDateForm
 from .models import Company, TestModel
@@ -1305,6 +1306,64 @@ class MiscTests(SimpleTestCase):
         r.COOKIES = {settings.LANGUAGE_COOKIE_NAME: 'zh-hans'}
         r.META = {'HTTP_ACCEPT_LANGUAGE': 'de'}
         self.assertEqual(g(r), 'zh-hans')
+        
+    @override_settings(
+        USE_I18N=True,
+        LANGUAGES=[
+            ("en", "English"),
+            ("ar-dz", "Algerian Arabic"),
+            ("de", "German"),
+            ("de-at", "Austrian German"),
+            ("pt-BR", "Portuguese (Brazil)"),
+        ],
+    )
+    def test_get_supported_language_variant_real(self):
+        g = trans_real.get_supported_language_variant
+        self.assertEqual(g("en"), "en")
+        self.assertEqual(g("en-gb"), "en")
+        self.assertEqual(g("de"), "de")
+        self.assertEqual(g("de-at"), "de-at")
+        self.assertEqual(g("de-ch"), "de")
+        self.assertEqual(g("pt-br"), "pt-br")
+        self.assertEqual(g("pt-BR"), "pt-BR")
+        self.assertEqual(g("pt"), "pt-br")
+        self.assertEqual(g("pt-pt"), "pt-br")
+        self.assertEqual(g("ar-dz"), "ar-dz")
+        self.assertEqual(g("ar-DZ"), "ar-DZ")
+        with self.assertRaises(LookupError):
+            g("pt", strict=True)
+        with self.assertRaises(LookupError):
+            g("pt-pt", strict=True)
+        with self.assertRaises(LookupError):
+            g("xyz")
+        with self.assertRaises(LookupError):
+            g("xy-zz")
+        msg = "'lang_code' exceeds the maximum accepted length"
+        with self.assertRaises(LookupError):
+            g("x" * LANGUAGE_CODE_MAX_LENGTH)
+        with self.assertRaisesMessage(ValueError, msg):
+            g("x" * (LANGUAGE_CODE_MAX_LENGTH + 1))
+        # 167 * 3 = 501 which is LANGUAGE_CODE_MAX_LENGTH + 1.
+        self.assertEqual(g("en-" * 167), "en")
+        with self.assertRaisesMessage(ValueError, msg):
+            g("en-" * 167, strict=True)
+        self.assertEqual(g("en-" * 30000), "en")  # catastrophic test
+
+    def test_get_supported_language_variant_null(self):
+        g = trans_null.get_supported_language_variant
+        self.assertEqual(g(settings.LANGUAGE_CODE), settings.LANGUAGE_CODE)
+        with self.assertRaises(LookupError):
+            g("pt")
+        with self.assertRaises(LookupError):
+            g("de")
+        with self.assertRaises(LookupError):
+            g("de-at")
+        with self.assertRaises(LookupError):
+            g("de", strict=True)
+        with self.assertRaises(LookupError):
+            g("de-at", strict=True)
+        with self.assertRaises(LookupError):
+            g("xyz")
 
     @override_settings(
         LANGUAGES=[
-- 
2.45.2

Places

File CVE-2024-39614.patch of Package python-Django.35578

Places