Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

Thanks to Guido Vranken for initial report.

1 files changed, 2 insertions, 2 deletions

diff --git a/django/utils/html.py b/django/utils/html.py
index d8fa00dab8..94aa0ff35e 100644
--- a/django/utils/html.py
+++ b/django/utils/html.py
@@ -181,8 +181,8 @@ def strip_tags(value):
     value = str(value)
     while '<' in value and '>' in value:
         new_value = _strip_once(value)
-        if len(new_value) >= len(value):
-            # _strip_once was not able to detect more tags
+        if value.count('<') == new_value.count('<'):
+            # _strip_once wasn't able to detect more tags.
             break
         value = new_value
     return value