From 9f8287a3f145fe5cbe71ef5573ea8898404727ad Mon Sep 17 00:00:00 2001 From: Jacob Kaplan-Moss Date: Fri, 9 Oct 2009 20:57:59 +0000 Subject: SECURITY ALERT: Corrected regular expressions for URL and email fields. Certain email addresses/URLs could trigger a catastrophic backtracking situation, causing 100% CPU and server overload. If deliberately triggered, this could be the basis of a denial-of-service attack. This security vulnerability was disclosed in public, so we're skipping our normal security release process to get the fix out as soon as possible. This is a security related update. A full announcement, as well as backports for the 1.1.X and 1.0.X series will follow. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11603 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- tests/regressiontests/forms/fields.py | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) (limited to 'tests/regressiontests/forms') diff --git a/tests/regressiontests/forms/fields.py b/tests/regressiontests/forms/fields.py index 9d9d7227b9..9d407d9ea7 100644 --- a/tests/regressiontests/forms/fields.py +++ b/tests/regressiontests/forms/fields.py @@ -767,6 +767,13 @@ u'example@valid-----hyphens.com' >>> f.clean('example@valid-with-hyphens.com') u'example@valid-with-hyphens.com' +# Check for runaway regex security problem. This will take for-freeking-ever +# if the security fix isn't in place. +>>> f.clean('viewx3dtextx26qx3d@yahoo.comx26latlngx3d15854521645943074058') +Traceback (most recent call last): + ... +ValidationError: [u'Enter a valid e-mail address.'] + >>> f = EmailField(required=False) >>> f.clean('') u'' @@ -972,6 +979,32 @@ ValidationError: [u'Enter a valid URL.'] Traceback (most recent call last): ... ValidationError: [u'Enter a valid URL.'] +>>> f.clean('.') +Traceback (most recent call last): +... +ValidationError: [u'Enter a valid URL.'] +>>> f.clean('com.') +Traceback (most recent call last): +... +ValidationError: [u'Enter a valid URL.'] +>>> f.clean('http://example.com.') +u'http://example.com./' +>>> f.clean('example.com.') +u'http://example.com./' + +# hangs "forever" if catastrophic backtracking in ticket:#11198 not fixed +>>> f.clean('http://%s' % ("X"*200,)) +Traceback (most recent call last): +... +ValidationError: [u'Enter a valid URL.'] + +# a second test, to make sure the problem is really addressed, even on +# domains that don't fail the domain label length check in the regex +>>> f.clean('http://%s' % ("X"*60,)) +Traceback (most recent call last): +... +ValidationError: [u'Enter a valid URL.'] + >>> f.clean('http://.com') Traceback (most recent call last): ... -- cgit v1.3