From 17b51094d778b421bb2b3aae0c270894b050455d Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Tue, 19 Sep 2023 09:51:48 -0300
Subject: Fixed CVE-2023-43665 -- Mitigated potential DoS in
 django.utils.text.Truncator when truncating HTML text.

Thanks Wenchao Li of Alibaba Group for the report.
---
 docs/ref/templates/builtins.txt | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'docs/ref')

diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index e0e06dafe8..038a2093c4 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -2648,6 +2648,16 @@ If ``value`` is ``"<p>Joel is a slug</p>"``, the output will be
 
 Newlines in the HTML content will be preserved.
 
+.. admonition:: Size of input string
+
+    Processing large, potentially malformed HTML strings can be
+    resource-intensive and impact service performance. ``truncatechars_html``
+    limits input to the first five million characters.
+
+.. versionchanged:: 3.2.22
+
+    In older versions, strings over five million characters were processed.
+
 .. templatefilter:: truncatewords
 
 ``truncatewords``
@@ -2690,6 +2700,16 @@ If ``value`` is ``"<p>Joel is a slug</p>"``, the output will be
 
 Newlines in the HTML content will be preserved.
 
+.. admonition:: Size of input string
+
+    Processing large, potentially malformed HTML strings can be
+    resource-intensive and impact service performance. ``truncatewords_html``
+    limits input to the first five million characters.
+
+.. versionchanged:: 3.2.22
+
+    In older versions, strings over five million characters were processed.
+
 .. templatefilter:: unordered_list
 
 ``unordered_list``
-- 
cgit v1.3