diff options
| -rw-r--r-- | django/utils/translation/trans_real.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/django/utils/translation/trans_real.py b/django/utils/translation/trans_real.py index bf6ad7ee95..6bbdbe5f20 100644 --- a/django/utils/translation/trans_real.py +++ b/django/utils/translation/trans_real.py @@ -389,12 +389,16 @@ def all_locale_paths(): return [globalpath] + list(settings.LOCALE_PATHS) -@lru_cache.lru_cache() +@lru_cache.lru_cache(maxsize=1000) def check_for_language(lang_code): """ Checks whether there is a global language file for the given language code. This is used to decide whether a user-provided language is available. + + lru_cache should have a maxsize to prevent from memory exhaustion attacks, + as the provided language codes are taken from the HTTP request. See also + <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>. """ # First, a quick check to make sure lang_code is well-formed (#21458) if not language_code_re.search(lang_code): |