From 8124c42601b9abfeb234056092a62a22a22107cb Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Tue, 19 Sep 2023 09:51:48 -0300
Subject: [5.0.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in
 django.utils.text.Truncator when truncating HTML text.

Thanks Wenchao Li of Alibaba Group for the report.
---
 docs/ref/templates/builtins.txt | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'docs/ref')

diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index 65579677ca..536f9259bc 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -2676,6 +2676,16 @@ If ``value`` is ``"<p>Joel is a slug</p>"``, the output will be
 
 Newlines in the HTML content will be preserved.
 
+.. admonition:: Size of input string
+
+    Processing large, potentially malformed HTML strings can be
+    resource-intensive and impact service performance. ``truncatechars_html``
+    limits input to the first five million characters.
+
+.. versionchanged:: 3.2.22
+
+    In older versions, strings over five million characters were processed.
+
 .. templatefilter:: truncatewords
 
 ``truncatewords``
@@ -2718,6 +2728,16 @@ If ``value`` is ``"<p>Joel is a slug</p>"``, the output will be
 
 Newlines in the HTML content will be preserved.
 
+.. admonition:: Size of input string
+
+    Processing large, potentially malformed HTML strings can be
+    resource-intensive and impact service performance. ``truncatewords_html``
+    limits input to the first five million characters.
+
+.. versionchanged:: 3.2.22
+
+    In older versions, strings over five million characters were processed.
+
 .. templatefilter:: unordered_list
 
 ``unordered_list``
-- 
cgit v1.3