[2.2.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

Thanks to Guido Vranken for initial report.

3 files changed, 51 insertions, 0 deletions

diff --git a/docs/releases/1.11.23.txt b/docs/releases/1.11.23.txt
index 6058bb8a81..c95ffd9a50 100644
--- a/docs/releases/1.11.23.txt
+++ b/docs/releases/1.11.23.txt
@@ -19,3 +19,20 @@ filters, which were thus vulnerable.
 The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
+
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
diff --git a/docs/releases/2.1.11.txt b/docs/releases/2.1.11.txt
index f4ee3dbd30..9cae1e6f2e 100644
--- a/docs/releases/2.1.11.txt
+++ b/docs/releases/2.1.11.txt
@@ -19,3 +19,20 @@ filters, which were thus vulnerable.
 The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
+
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
diff --git a/docs/releases/2.2.4.txt b/docs/releases/2.2.4.txt
index b22aa42482..c965373677 100644
--- a/docs/releases/2.2.4.txt
+++ b/docs/releases/2.2.4.txt
@@ -20,6 +20,23 @@ The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
 
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
+
 Bugfixes
 ========