From 869b34e9b3be3a4cfcb3a145f218ffd3f5e3fd79 Mon Sep 17 00:00:00 2001 From: Florian Apolloner Date: Fri, 19 Jul 2019 17:04:53 +0200 Subject: [1.11.x] Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri(). Thanks to Guido Vranken for initial report. --- tests/utils_tests/test_encoding.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'tests') diff --git a/tests/utils_tests/test_encoding.py b/tests/utils_tests/test_encoding.py index 688b46194d..2b4bcff870 100644 --- a/tests/utils_tests/test_encoding.py +++ b/tests/utils_tests/test_encoding.py @@ -2,12 +2,13 @@ from __future__ import unicode_literals import datetime +import sys import unittest from django.utils import six from django.utils.encoding import ( escape_uri_path, filepath_to_uri, force_bytes, force_text, iri_to_uri, - smart_text, uri_to_iri, + repercent_broken_unicode, smart_text, uri_to_iri, ) from django.utils.functional import SimpleLazyObject from django.utils.http import urlquote_plus @@ -76,6 +77,15 @@ class TestEncodingUtils(unittest.TestCase): self.assertEqual(smart_text(1), '1') self.assertEqual(smart_text('foo'), 'foo') + def test_repercent_broken_unicode_recursion_error(self): + # Prepare a string long enough to force a recursion error if the tested + # function uses recursion. + data = b'\xfc' * sys.getrecursionlimit() + try: + self.assertEqual(repercent_broken_unicode(data), b'%FC' * sys.getrecursionlimit()) + except RecursionError: + self.fail('Unexpected RecursionError raised.') + class TestRFC3987IEncodingUtils(unittest.TestCase): -- cgit v1.3