mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-13 17:39:57 +00:00
python3-django: fix CVE-2024-41991
Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41991 Upstream-patch: https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Saravanan
committed by
Gyorgy Sarvari
Gyorgy Sarvari
parent
edb07bc11e
commit
64e4cf9933
@@ -0,0 +1,143 @@
|
||||
From efea1ef7e2190e3f77ca0651b5458297bc0f6a9f Mon Sep 17 00:00:00 2001
|
||||
From: Marc Deslauriers <marc.deslauriers@ubuntu.com>
|
||||
Date: Wed, 30 Apr 2025 10:34:27 -0400
|
||||
Subject: [PATCH] Fixed CVE-2024-41991 -- Prevented potential ReDoS in
|
||||
django.utils.html.urlize() and AdminURLFieldWidget.
|
||||
|
||||
Thanks Seokchan Yoon for the report.
|
||||
|
||||
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
||||
|
||||
CVE: CVE-2024-41991
|
||||
|
||||
Upstream-Status: Backport
|
||||
https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f/
|
||||
|
||||
Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
|
||||
---
|
||||
django/contrib/admin/widgets.py | 2 +-
|
||||
django/utils/html.py | 10 ++++++++--
|
||||
docs/releases/3.2.25.txt | 7 +++++++
|
||||
tests/admin_widgets/tests.py | 7 ++++++-
|
||||
tests/utils_tests/test_html.py | 13 +++++++++++++
|
||||
5 files changed, 35 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/django/contrib/admin/widgets.py b/django/contrib/admin/widgets.py
|
||||
index aeb7477..b7dd0d8 100644
|
||||
--- a/django/contrib/admin/widgets.py
|
||||
+++ b/django/contrib/admin/widgets.py
|
||||
@@ -339,7 +339,7 @@ class AdminURLFieldWidget(forms.URLInput):
|
||||
context = super().get_context(name, value, attrs)
|
||||
context['current_label'] = _('Currently:')
|
||||
context['change_label'] = _('Change:')
|
||||
- context['widget']['href'] = smart_urlquote(context['widget']['value']) if value else ''
|
||||
+ context['widget']['href'] = smart_urlquote(context['widget']['value']) if url_valid else ''
|
||||
context['url_valid'] = url_valid
|
||||
return context
|
||||
|
||||
diff --git a/django/utils/html.py b/django/utils/html.py
|
||||
index 3bc02b8..44c6b7b 100644
|
||||
--- a/django/utils/html.py
|
||||
+++ b/django/utils/html.py
|
||||
@@ -29,6 +29,8 @@ simple_url_2_re = _lazy_re_compile(
|
||||
re.IGNORECASE
|
||||
)
|
||||
|
||||
+MAX_URL_LENGTH = 2048
|
||||
+
|
||||
|
||||
@keep_lazy(str, SafeString)
|
||||
def escape(text):
|
||||
@@ -298,6 +300,10 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):
|
||||
except ValueError:
|
||||
# value contains more than one @.
|
||||
return False
|
||||
+ # Max length for domain name labels is 63 characters per RFC 1034.
|
||||
+ # Helps to avoid ReDoS vectors in the domain part.
|
||||
+ if len(p2) > 63:
|
||||
+ return False
|
||||
# Dot must be in p2 (e.g. example.com)
|
||||
if '.' not in p2 or p2.startswith('.'):
|
||||
return False
|
||||
@@ -316,9 +322,9 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):
|
||||
# Make URL we want to point to.
|
||||
url = None
|
||||
nofollow_attr = ' rel="nofollow"' if nofollow else ''
|
||||
- if simple_url_re.match(middle):
|
||||
+ if len(middle) <= MAX_URL_LENGTH and simple_url_re.match(middle):
|
||||
url = smart_urlquote(html.unescape(middle))
|
||||
- elif simple_url_2_re.match(middle):
|
||||
+ elif len(middle) <= MAX_URL_LENGTH and simple_url_2_re.match(middle):
|
||||
url = smart_urlquote('http://%s' % html.unescape(middle))
|
||||
elif ':' not in middle and is_email_simple(middle):
|
||||
local, domain = middle.rsplit('@', 1)
|
||||
diff --git a/docs/releases/3.2.25.txt b/docs/releases/3.2.25.txt
|
||||
index 60236d5..67dc8a2 100644
|
||||
--- a/docs/releases/3.2.25.txt
|
||||
+++ b/docs/releases/3.2.25.txt
|
||||
@@ -59,6 +59,13 @@ directory-traversal via certain inputs when calling :meth:`save()
|
||||
|
||||
Built-in ``Storage`` sub-classes were not affected by this vulnerability.
|
||||
|
||||
+CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html.urlize()`` and ``AdminURLFieldWidget``
|
||||
+===========================================================================================================
|
||||
+
|
||||
+:tfilter:`urlize`, :tfilter:`urlizetrunc`, and ``AdminURLFieldWidget`` were
|
||||
+subject to a potential denial-of-service attack via certain inputs with a very
|
||||
+large number of Unicode characters.
|
||||
+
|
||||
Bugfixes
|
||||
========
|
||||
|
||||
diff --git a/tests/admin_widgets/tests.py b/tests/admin_widgets/tests.py
|
||||
index f701f1a..c532199 100644
|
||||
--- a/tests/admin_widgets/tests.py
|
||||
+++ b/tests/admin_widgets/tests.py
|
||||
@@ -353,7 +353,12 @@ class AdminSplitDateTimeWidgetTest(SimpleTestCase):
|
||||
class AdminURLWidgetTest(SimpleTestCase):
|
||||
def test_get_context_validates_url(self):
|
||||
w = widgets.AdminURLFieldWidget()
|
||||
- for invalid in ['', '/not/a/full/url/', 'javascript:alert("Danger XSS!")']:
|
||||
+ for invalid in [
|
||||
+ "",
|
||||
+ "/not/a/full/url/",
|
||||
+ 'javascript:alert("Danger XSS!")',
|
||||
+ "http://" + "한.글." * 1_000_000 + "com",
|
||||
+ ]:
|
||||
with self.subTest(url=invalid):
|
||||
self.assertFalse(w.get_context('name', invalid, {})['url_valid'])
|
||||
self.assertTrue(w.get_context('name', 'http://example.com', {})['url_valid'])
|
||||
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
|
||||
index 30f5ba6..93458ac 100644
|
||||
--- a/tests/utils_tests/test_html.py
|
||||
+++ b/tests/utils_tests/test_html.py
|
||||
@@ -255,6 +255,15 @@ class TestUtilsHtml(SimpleTestCase):
|
||||
'Search for <a href="http://google.com/?q=">google.com/?q=</a>!'
|
||||
),
|
||||
('foo@example.com', '<a href="mailto:foo@example.com">foo@example.com</a>'),
|
||||
+ (
|
||||
+ "test@" + "한.글." * 15 + "aaa",
|
||||
+ '<a href="mailto:test@'
|
||||
+ + "xn--6q8b.xn--bj0b." * 15
|
||||
+ + 'aaa">'
|
||||
+ + "test@"
|
||||
+ + "한.글." * 15
|
||||
+ + "aaa</a>",
|
||||
+ ),
|
||||
)
|
||||
for value, output in tests:
|
||||
with self.subTest(value=value):
|
||||
@@ -263,6 +272,10 @@ class TestUtilsHtml(SimpleTestCase):
|
||||
def test_urlize_unchanged_inputs(self):
|
||||
tests = (
|
||||
('a' + '@a' * 50000) + 'a', # simple_email_re catastrophic test
|
||||
+ # Unicode domain catastrophic tests.
|
||||
+ "a@" + "한.글." * 1_000_000 + "a",
|
||||
+ "http://" + "한.글." * 1_000_000 + "com",
|
||||
+ "www." + "한.글." * 1_000_000 + "com",
|
||||
('a' + '.' * 1000000) + 'a', # trailing_punctuation catastrophic test
|
||||
'foo@',
|
||||
'@foo.com',
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@@ -12,6 +12,7 @@ SRC_URI += "\
|
||||
file://CVE-2025-57833.patch \
|
||||
file://CVE-2024-39329.patch \
|
||||
file://CVE-2024-39330.patch \
|
||||
file://CVE-2024-41991.patch \
|
||||
"
|
||||
|
||||
# Set DEFAULT_PREFERENCE so that the LTS version of django is built by
|
||||
|
||||
Reference in New Issue
Block a user