File CVE-2024-41991.patch of Package python-Django.35578

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2024-41991.patch of Package python-Django.35578

From 772a73f70c3d249c99c23012849e66276b7b0715 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 10 Jul 2024 20:30:12 +0200
Subject: [PATCH 3/4] [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS
 in django.utils.html.urlize() and AdminURLFieldWidget.

Thanks Seokchan Yoon for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
---
 django/contrib/admin/widgets.py |  2 +-
 django/utils/html.py            | 10 ++++++++--
 tests/admin_widgets/tests.py    |  7 ++++++-
 tests/utils_tests/test_html.py  | 13 +++++++++++++
 5 files changed, 35 insertions(+), 4 deletions(-)

Index: Django-2.0.7/django/contrib/admin/widgets.py
===================================================================
--- Django-2.0.7.orig/django/contrib/admin/widgets.py
+++ Django-2.0.7/django/contrib/admin/widgets.py
@@ -371,7 +371,7 @@ class AdminURLFieldWidget(forms.URLInput
         context = super().get_context(name, value, attrs)
         context['current_label'] = _('Currently:')
         context['change_label'] = _('Change:')
-        context['widget']['href'] = smart_urlquote(context['widget']['value']) if value else ''
+        context['widget']['href'] = smart_urlquote(context['widget']['value']) if url_valid else ''
         context['url_valid'] = url_valid
         return context
 
Index: Django-2.0.7/django/utils/html.py
===================================================================
--- Django-2.0.7.orig/django/utils/html.py
+++ Django-2.0.7/django/utils/html.py
@@ -26,6 +26,8 @@ word_split_re = re.compile(r'''([\s<>"']
 simple_url_re = re.compile(r'^https?://\[?\w', re.IGNORECASE)
 simple_url_2_re = re.compile(r'^www\.|^(?!http)\w[^@]+\.(com|edu|gov|int|mil|net|org)($|/.*)$', re.IGNORECASE)
 
+MAX_URL_LENGTH = 2048
+
 
 @keep_lazy(str, SafeText)
 def escape(text):
@@ -351,6 +353,10 @@ def urlize(text, trim_url_limit=None, no
         except ValueError:
             # value contains more than one @.
             return False
+        # Max length for domain name labels is 63 characters per RFC 1034.
+        # Helps to avoid ReDoS vectors in the domain part.
+        if len(p2) > 63:
+            return False
         # Dot must be in p2 (e.g. example.com)
         if '.' not in p2 or p2.startswith('.'):
             return False
@@ -369,10 +375,10 @@ def urlize(text, trim_url_limit=None, no
             # Make URL we want to point to.
             url = None
             nofollow_attr = ' rel="nofollow"' if nofollow else ''
-            if simple_url_re.match(middle):
+            if len(middle) <= MAX_URL_LENGTH and simple_url_re.match(middle):
                 middle, middle_unescaped, trail = unescape(middle, trail)
                 url = smart_urlquote(middle_unescaped)
-            elif simple_url_2_re.match(middle):
+            elif len(middle) <= MAX_URL_LENGTH and simple_url_2_re.match(middle):
                 middle, middle_unescaped, trail = unescape(middle, trail)
                 url = smart_urlquote('http://%s' % middle_unescaped)
             elif ':' not in middle and is_email_simple(middle):
Index: Django-2.0.7/tests/admin_widgets/tests.py
===================================================================
--- Django-2.0.7.orig/tests/admin_widgets/tests.py
+++ Django-2.0.7/tests/admin_widgets/tests.py
@@ -335,7 +335,12 @@ class AdminSplitDateTimeWidgetTest(Simpl
 class AdminURLWidgetTest(SimpleTestCase):
     def test_get_context_validates_url(self):
         w = widgets.AdminURLFieldWidget()
-        for invalid in ['', '/not/a/full/url/', 'javascript:alert("Danger XSS!")']:
+        for invalid in [
+            "",
+            "/not/a/full/url/",
+            'javascript:alert("Danger XSS!")',
+            "http://" + "한.글." * 1_000_000 + "com",
+        ]:
             with self.subTest(url=invalid):
                 self.assertFalse(w.get_context('name', invalid, {})['url_valid'])
         self.assertTrue(w.get_context('name', 'http://example.com', {})['url_valid'])
Index: Django-2.0.7/tests/utils_tests/test_html.py
===================================================================
--- Django-2.0.7.orig/tests/utils_tests/test_html.py
+++ Django-2.0.7/tests/utils_tests/test_html.py
@@ -220,6 +220,10 @@ class TestUtilsHtml(SimpleTestCase):
     def test_urlize_unchanged_inputs(self):
         tests = (
             ("a" + "@a" * 50000) + "a",  # simple_email_re catastrophic test
+            # Unicode domain catastrophic tests.
+            "a@" + "한.글." * 1_000_000 + "a",
+            "http://" + "한.글." * 1_000_000 + "com",
+            "www." + "한.글." * 1_000_000 + "com",
             ("a" + "." * 1000000) + "a",  # trailing_punctuation catastrophic test
             "foo@",
             "@foo.com",

Places

File CVE-2024-41991.patch of Package python-Django.35578

Places