diff options
| author | varunkasyap <varunkasyap@hotmail.com> | 2025-11-26 14:28:24 -0300 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-11-26 17:31:17 -0300 |
| commit | e6973490373dca340e36f2db3eae1eb26a6a2d80 (patch) | |
| tree | 614503d6f6049610d3789dd4ea7802c0d687235f /scripts | |
| parent | 7d7f27bc9881dede6337212db1e9ccdbd37addae (diff) | |
[4.2.x] Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.
Refs CVE-2025-64458.
The previous limit of 2048 characters reused the URLValidator constant
and proved too restrictive for legitimate redirects to some third-party
services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH`
constant (defaulting to 16384) and uses it in HttpResponseRedirectBase.
Thanks Jacob Walls for report and review.
Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions