diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2019-07-15 12:00:06 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-07-29 11:06:54 +0200 |
| commit | e34f3c0e9ee5fc9022428fe91640638bafd4cda7 (patch) | |
| tree | 5f2fa546ee683217d2b1068b6e26f34f90322689 /tests | |
| parent | c3289717c6f21a8cf23daff1c78c0c014b94041f (diff) | |
[2.2.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/utils_tests/test_html.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py index 8057fdc051..5cc2d9b95d 100644 --- a/tests/utils_tests/test_html.py +++ b/tests/utils_tests/test_html.py @@ -88,6 +88,8 @@ class TestUtilsHtml(SimpleTestCase): ('&gotcha&#;<>', '&gotcha&#;<>'), ('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'), ('<script>alert()</script>&h', 'alert()h'), + ('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'), + ('X<<<<br>br>br>br>X', 'XX'), ) for value, output in items: with self.subTest(value=value, output=output): |