From fc76660f589ac07e45e9cd34ccb8087aeb11904b Mon Sep 17 00:00:00 2001 From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Date: Fri, 12 Jul 2024 11:38:34 +0200 Subject: [4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks Elias Myllymäki for the report. Co-authored-by: Shai Berger --- django/template/defaultfilters.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'django') diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py index d446b54ade..3f89eba6bb 100644 --- a/django/template/defaultfilters.py +++ b/django/template/defaultfilters.py @@ -163,6 +163,19 @@ def floatformat(text, arg=-1): except ValueError: return input_val + _, digits, exponent = d.as_tuple() + try: + number_of_digits_and_exponent_sum = len(digits) + abs(exponent) + except TypeError: + # Exponent values can be "F", "n", "N". + number_of_digits_and_exponent_sum = 0 + + # Values with more than 200 digits, or with a large exponent, are returned "as is" + # to avoid high memory consumption and potential denial-of-service attacks. + # The cut-off of 200 is consistent with django.utils.numberformat.floatformat(). + if number_of_digits_and_exponent_sum > 200: + return input_val + try: m = int(d) - d except (ValueError, OverflowError, InvalidOperation): -- cgit v1.3