diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2019-07-15 11:46:09 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-07-29 11:18:34 +0200 |
| commit | 42a66e969023c00536256469f0e8b8a099ef109d (patch) | |
| tree | 30c19dbca291367841df1c7514cbb2dbf802a3cc /django/utils/text.py | |
| parent | 693046e54b9f207dece1907a2515ce555cec83be (diff) | |
[1.11.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues when truncating HTML.
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'django/utils/text.py')
| -rw-r--r-- | django/utils/text.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/django/utils/text.py b/django/utils/text.py index a6172c41b0..f221747f6f 100644 --- a/django/utils/text.py +++ b/django/utils/text.py @@ -27,8 +27,8 @@ def capfirst(x): # Set up regular expressions -re_words = re.compile(r'<.*?>|((?:\w[-\w]*|&.*?;)+)', re.U | re.S) -re_chars = re.compile(r'<.*?>|(.)', re.U | re.S) +re_words = re.compile(r'<[^>]+?>|([^<>\s]+)', re.S) +re_chars = re.compile(r'<[^>]+?>|(.)', re.S) re_tag = re.compile(r'<(/)?(\S+?)(?:(\s*/)|\s.*?)?>', re.S) re_newlines = re.compile(r'\r\n|\r') # Used in normalize_newlines re_camel_case = re.compile(r'(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))') |