[1.11.x] Fixed CVE-2018-7536 -- Fixed catastrophic backtracking in urlize and urlizetrunc template filters.

Thanks Florian Apolloner for assisting with the patch.

1 files changed, 8 insertions, 0 deletions

diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
index 7982f4fe42..1bebe94521 100644
--- a/tests/utils_tests/test_html.py
+++ b/tests/utils_tests/test_html.py
@@ -232,3 +232,11 @@ class TestUtilsHtml(SimpleTestCase):
             @html.html_safe
             class HtmlClass(object):
                 pass
+
+    def test_urlize_unchanged_inputs(self):
+        tests = (
+            ('a' + '@a' * 50000) + 'a',  # simple_email_re catastrophic test
+            ('a' + '.' * 1000000) + 'a',  # trailing_punctuation catastrophic test
+        )
+        for value in tests:
+            self.assertEqual(html.urlize(value), value)