From 1c83fc88d6928a5ab53bc3dde79dad3cc0bfcfdc Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Wed, 4 Mar 2015 08:11:25 -0500 Subject: Fixed an infinite loop possibility in strip_tags(). This is a security fix; disclosure to follow shortly. --- django/utils/html.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'django/utils') diff --git a/django/utils/html.py b/django/utils/html.py index 9f9fbdb2a5..1cf131b8a0 100644 --- a/django/utils/html.py +++ b/django/utils/html.py @@ -175,8 +175,10 @@ def strip_tags(value): # is redundant, but helps to reduce number of executions of _strip_once. while '<' in value and '>' in value: new_value = _strip_once(value) - if new_value == value: - # _strip_once was not able to detect more tags + if len(new_value) >= len(value): + # _strip_once was not able to detect more tags or length increased + # due to http://bugs.python.org/issue20288 + # (affects Python 2 < 2.7.7 and Python 3 < 3.3.5) break value = new_value return value -- cgit v1.3