mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-27 12:01:38 +01:00
e2da1298ac
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32873
Upstream-patch:
9cd8028f3e/
Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
108 lines
4.1 KiB
Diff
108 lines
4.1 KiB
Diff
From 9cd8028f3e38dca8e51c1388f474eecbe7d6ca3c Mon Sep 17 00:00:00 2001
|
|
From: Marc Deslauriers <marc.deslauriers@ubuntu.com>
|
|
Date: Wed, 30 Apr 2025 10:34:27 -0400
|
|
Subject: [PATCH] Fixed CVE-2025-32873 -- Mitigated potential DoS in
|
|
strip_tags().
|
|
|
|
Thanks to Elias Myllymaki for the report, and Shai Berger and Jake
|
|
Howard for the reviews.
|
|
|
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
|
|
Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.
|
|
|
|
CVE: CVE-2025-32873
|
|
|
|
Upstream-Status: Backport
|
|
https://github.com/django/django/commit/9cd8028f3e38dca8e51c1388f474eecbe7d6ca3c
|
|
|
|
Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
|
|
---
|
|
django/utils/html.py | 6 ++++++
|
|
docs/releases/2.2.28.txt | 11 +++++++++++
|
|
tests/utils_tests/test_html.py | 15 ++++++++++++++-
|
|
3 files changed, 31 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/django/utils/html.py b/django/utils/html.py
|
|
index 0d5ffd2..858a517 100644
|
|
--- a/django/utils/html.py
|
|
+++ b/django/utils/html.py
|
|
@@ -37,6 +37,9 @@ _html_escapes = {
|
|
ord("'"): ''',
|
|
}
|
|
|
|
+# HTML tag that opens but has no closing ">" after 1k+ chars.
|
|
+long_open_tag_without_closing_re = _lazy_re_compile(r"<[a-zA-Z][^>]{1000,}")
|
|
+
|
|
|
|
@keep_lazy(str, SafeText)
|
|
def escape(text):
|
|
@@ -188,6 +191,9 @@ def _strip_once(value):
|
|
def strip_tags(value):
|
|
"""Return the given HTML with all tags stripped."""
|
|
value = str(value)
|
|
+ for long_open_tag in long_open_tag_without_closing_re.finditer(value):
|
|
+ if long_open_tag.group().count("<") >= MAX_STRIP_TAGS_DEPTH:
|
|
+ raise SuspiciousOperation
|
|
# Note: in typical case this loop executes _strip_once twice (the second
|
|
# execution does not remove any more tags).
|
|
strip_tags_depth = 0
|
|
diff --git a/docs/releases/2.2.28.txt b/docs/releases/2.2.28.txt
|
|
index 3503f38..1676bbd 100644
|
|
--- a/docs/releases/2.2.28.txt
|
|
+++ b/docs/releases/2.2.28.txt
|
|
@@ -143,3 +143,14 @@ directory-traversal via certain inputs when calling :meth:`save()
|
|
|
|
Built-in ``Storage`` sub-classes were not affected by this vulnerability.
|
|
|
|
+CVE-2025-32873: Denial-of-service possibility in ``strip_tags()``
|
|
+=================================================================
|
|
+
|
|
+:func:`~django.utils.html.strip_tags` would be slow to evaluate certain inputs
|
|
+containing large sequences of incomplete HTML tags. This function is used to
|
|
+implement the :tfilter:`striptags` template filter, which was thus also
|
|
+vulnerable.
|
|
+
|
|
+:func:`~django.utils.html.strip_tags` now raises a :exc:`.SuspiciousOperation`
|
|
+exception if it encounters an unusually large number of unclosed opening tags.
|
|
+
|
|
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
|
|
index 2f412e1..653deb2 100644
|
|
--- a/tests/utils_tests/test_html.py
|
|
+++ b/tests/utils_tests/test_html.py
|
|
@@ -92,17 +92,30 @@ class TestUtilsHtml(SimpleTestCase):
|
|
('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),
|
|
('X<<<<br>br>br>br>X', 'XX'),
|
|
("<" * 50 + "a>" * 50, ""),
|
|
+ (">" + "<a" * 500 + "a", ">" + "<a" * 500 + "a"),
|
|
+ ("<a" * 49 + "a" * 951, "<a" * 49 + "a" * 951),
|
|
+ ("<" + "a" * 1_002, "<" + "a" * 1_002),
|
|
)
|
|
for value, output in items:
|
|
with self.subTest(value=value, output=output):
|
|
self.check_output(strip_tags, value, output)
|
|
self.check_output(strip_tags, lazystr(value), output)
|
|
|
|
- def test_strip_tags_suspicious_operation(self):
|
|
+ def test_strip_tags_suspicious_operation_max_depth(self):
|
|
value = "<" * 51 + "a>" * 51, "<a>"
|
|
with self.assertRaises(SuspiciousOperation):
|
|
strip_tags(value)
|
|
|
|
+ def test_strip_tags_suspicious_operation_large_open_tags(self):
|
|
+ items = [
|
|
+ ">" + "<a" * 501,
|
|
+ "<a" * 50 + "a" * 950,
|
|
+ ]
|
|
+ for value in items:
|
|
+ with self.subTest(value=value):
|
|
+ with self.assertRaises(SuspiciousOperation):
|
|
+ strip_tags(value)
|
|
+
|
|
def test_strip_tags_files(self):
|
|
# Test with more lengthy content (also catching performance regressions)
|
|
for filename in ('strip_tags1.html', 'strip_tags2.txt'):
|
|
--
|
|
2.40.0
|
|
|