From 1ca63a66ef3163149ad822701273e8a1844192c2 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Sat, 24 Feb 2018 11:30:11 -0500 Subject: [1.8.x] Fixed CVE-2018-7536 -- Fixed catastrophic backtracking in urlize and urlizetrunc template filters. Thanks Florian Apolloner for assisting with the patch. --- tests/utils_tests/test_html.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'tests/utils_tests/test_html.py') diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py index bc9874c696..b108268c17 100644 --- a/tests/utils_tests/test_html.py +++ b/tests/utils_tests/test_html.py @@ -248,3 +248,11 @@ class TestUtilsHtml(SimpleTestCase): @html.html_safe class HtmlClass(object): pass + + def test_urlize_unchanged_inputs(self): + tests = ( + ('a' + '@a' * 50000) + 'a', # simple_email_re catastrophic test + ('a' + '.' * 1000000) + 'a', # trailing_punctuation catastrophic test + ) + for value in tests: + self.assertEqual(html.urlize(value), value) -- cgit v1.3