diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2019-07-15 12:00:06 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-07-29 11:20:43 +0200 |
| commit | 52479acce792ad80bb0f915f20b835f919993c72 (patch) | |
| tree | e34bce6441d55e96c73e571d542d722bf077d3dd /tests/utils_tests | |
| parent | 42a66e969023c00536256469f0e8b8a099ef109d (diff) | |
[1.11.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'tests/utils_tests')
| -rw-r--r-- | tests/utils_tests/test_html.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py index 1bebe94521..6122b695f3 100644 --- a/tests/utils_tests/test_html.py +++ b/tests/utils_tests/test_html.py @@ -86,6 +86,8 @@ class TestUtilsHtml(SimpleTestCase): # caused infinite loop on Pythons not patched with # http://bugs.python.org/issue20288 ('&gotcha&#;<>', '&gotcha&#;<>'), + ('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'), + ('X<<<<br>br>br>br>X', 'XX'), ) for value, output in items: self.check_output(f, value, output) |