diff options
| author | Tim Graham <timograham@gmail.com> | 2015-03-04 08:11:25 -0500 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2015-03-18 19:23:21 -0400 |
| commit | 5447709a571cd5d95971f1d5d21d4a7edcf85bbd (patch) | |
| tree | 98d1e20ddeefe436a1b1312671eeb8d9606d7e63 /docs | |
| parent | 5a8ef2a3cf0c370e35c0b891ab97f3a17ac255d4 (diff) | |
[1.8.x] Fixed an infinite loop possibility in strip_tags().
This is a security fix; disclosure to follow shortly.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.6.11.txt | 17 | ||||
| -rw-r--r-- | docs/releases/1.7.7.txt | 17 |
2 files changed, 34 insertions, 0 deletions
diff --git a/docs/releases/1.6.11.txt b/docs/releases/1.6.11.txt index da10a44301..a7d020c004 100644 --- a/docs/releases/1.6.11.txt +++ b/docs/releases/1.6.11.txt @@ -5,3 +5,20 @@ Django 1.6.11 release notes *March 18, 2015* Django 1.6.11 fixes two security issues in 1.6.10. + +Denial-of-service possibility with ``strip_tags()`` +=================================================== + +Last year :func:`~django.utils.html.strip_tags` was changed to work +iteratively. The problem is that the size of the input it's processing can +increase on each iteration which results in an infinite loop in +``strip_tags()``. This issue only affects versions of Python that haven't +received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely +Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported +the fix for the Python bug into their packages of earlier versions. + +To remedy this issue, ``strip_tags()`` will now return the original input if +it detects the length of the string it's processing increases. Remember that +absolutely NO guarantee is provided about the results of ``strip_tags()`` being +HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without +escaping it first, for example with :func:`~django.utils.html.escape`. diff --git a/docs/releases/1.7.7.txt b/docs/releases/1.7.7.txt index 21abbe3781..85c3154efd 100644 --- a/docs/releases/1.7.7.txt +++ b/docs/releases/1.7.7.txt @@ -6,6 +6,23 @@ Django 1.7.7 release notes Django 1.7.7 fixes several bugs and security issues in 1.7.6. +Denial-of-service possibility with ``strip_tags()`` +=================================================== + +Last year :func:`~django.utils.html.strip_tags` was changed to work +iteratively. The problem is that the size of the input it's processing can +increase on each iteration which results in an infinite loop in +``strip_tags()``. This issue only affects versions of Python that haven't +received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely +Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported +the fix for the Python bug into their packages of earlier versions. + +To remedy this issue, ``strip_tags()`` will now return the original input if +it detects the length of the string it's processing increases. Remember that +absolutely NO guarantee is provided about the results of ``strip_tags()`` being +HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without +escaping it first, for example with :func:`~django.utils.html.escape`. + Bugfixes ======== |