diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2023-06-14 12:23:06 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2023-07-03 08:32:26 +0200 |
| commit | 454f2fb93437f98917283336201b4048293f7582 (patch) | |
| tree | 6c0c1bf6d7b1c5c367cd4928a4d7e6e10638d7b9 /tests/validators/tests.py | |
| parent | 07cc014cb30bc3c343a25c81aad6820bbc72c0d9 (diff) | |
[3.2.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and URLValidator.
Thanks Seokchan Yoon for reports.
Diffstat (limited to 'tests/validators/tests.py')
| -rw-r--r-- | tests/validators/tests.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/tests/validators/tests.py b/tests/validators/tests.py index e39d0e3a1c..1065727a97 100644 --- a/tests/validators/tests.py +++ b/tests/validators/tests.py @@ -59,6 +59,7 @@ TEST_DATA = [ (validate_email, 'example@atm.%s' % ('a' * 64), ValidationError), (validate_email, 'example@%s.atm.%s' % ('b' * 64, 'a' * 63), ValidationError), + (validate_email, "example@%scom" % (("a" * 63 + ".") * 100), ValidationError), (validate_email, None, ValidationError), (validate_email, '', ValidationError), (validate_email, 'abc', ValidationError), @@ -246,6 +247,16 @@ TEST_DATA = [ (URLValidator(), None, ValidationError), (URLValidator(), 56, ValidationError), (URLValidator(), 'no_scheme', ValidationError), + ( + URLValidator(), + "http://example." + ("a" * 63 + ".") * 1000 + "com", + ValidationError, + ), + ( + URLValidator(), + "http://userid:password" + "d" * 2000 + "@example.aaaaaaaaaaaaa.com", + None, + ), # Newlines and tabs are not accepted. (URLValidator(), 'http://www.djangoproject.com/\n', ValidationError), (URLValidator(), 'http://[::ffff:192.9.5.5]\n', ValidationError), |