mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-12 15:31:45 +00:00
46701493ac
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41989 Upstream-patches:08c5a787264b066bde69dcd9746983fc76660f58Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
From 08c5a787262c1ae57f6517d4574b54a5fcaad124 Mon Sep 17 00:00:00 2001
|
|
From: Vlastimil Zíma <ziima@users.noreply.github.com>
|
|
Date: Mon, 24 Oct 2022 12:59:34 +0200
|
|
Subject: [PATCH] Fixed #34098 -- Fixed loss of precision for Decimal values in
|
|
floatformat filter.
|
|
|
|
Regression in 12f7928f5a455e330c0a7f19bc86b37baca12811.
|
|
|
|
CVE: CVE-2024-41989
|
|
|
|
Upstream-Status: Backport [https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124]
|
|
|
|
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
|
|
---
|
|
django/template/defaultfilters.py | 2 +-
|
|
tests/template_tests/filter_tests/test_floatformat.py | 4 ++++
|
|
2 files changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py
|
|
index a1d77f5..9ca530c 100644
|
|
--- a/django/template/defaultfilters.py
|
|
+++ b/django/template/defaultfilters.py
|
|
@@ -123,7 +123,7 @@ def floatformat(text, arg=-1):
|
|
of that value.
|
|
"""
|
|
try:
|
|
- input_val = repr(text)
|
|
+ input_val = str(text)
|
|
d = Decimal(input_val)
|
|
except InvalidOperation:
|
|
try:
|
|
diff --git a/tests/template_tests/filter_tests/test_floatformat.py b/tests/template_tests/filter_tests/test_floatformat.py
|
|
index cfc3eaf..acad66d 100644
|
|
--- a/tests/template_tests/filter_tests/test_floatformat.py
|
|
+++ b/tests/template_tests/filter_tests/test_floatformat.py
|
|
@@ -44,6 +44,10 @@ class FunctionTests(SimpleTestCase):
|
|
self.assertEqual(floatformat(0.12345, 2), '0.12')
|
|
self.assertEqual(floatformat(Decimal('555.555'), 2), '555.56')
|
|
self.assertEqual(floatformat(Decimal('09.000')), '9')
|
|
+ self.assertEqual(
|
|
+ floatformat(Decimal("123456.123456789012345678901"), 21),
|
|
+ "123456.123456789012345678901",
|
|
+ )
|
|
self.assertEqual(floatformat('foo'), '')
|
|
self.assertEqual(floatformat(13.1031, 'bar'), '13.1031')
|
|
self.assertEqual(floatformat(18.125, 2), '18.13')
|
|
--
|
|
2.40.0
|