diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2019-07-15 11:46:09 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-07-29 11:09:18 +0200 |
| commit | c23723a1551340cc7d3126f04fcfd178fa224193 (patch) | |
| tree | 81336da419e3bf9b62843fc7a17872b180558646 /django/utils | |
| parent | 24eba901eb9795ee87eddd5447ede62053fe59d4 (diff) | |
[2.1.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues when truncating HTML.
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'django/utils')
| -rw-r--r-- | django/utils/text.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/django/utils/text.py b/django/utils/text.py index 746a67ee00..118fd0ec96 100644 --- a/django/utils/text.py +++ b/django/utils/text.py @@ -18,8 +18,8 @@ def capfirst(x): # Set up regular expressions -re_words = re.compile(r'<.*?>|((?:\w[-\w]*|&.*?;)+)', re.S) -re_chars = re.compile(r'<.*?>|(.)', re.S) +re_words = re.compile(r'<[^>]+?>|([^<>\s]+)', re.S) +re_chars = re.compile(r'<[^>]+?>|(.)', re.S) re_tag = re.compile(r'<(/)?(\S+?)(?:(\s*/)|\s.*?)?>', re.S) re_newlines = re.compile(r'\r\n|\r') # Used in normalize_newlines re_camel_case = re.compile(r'(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))') |