2015-03-04 20:49:12 +08:00
|
|
|
===========================
|
|
|
|
|
Django 1.6.11 release notes
|
|
|
|
|
===========================
|
|
|
|
|
|
|
|
|
|
*March 18, 2015*
|
|
|
|
|
|
|
|
|
|
Django 1.6.11 fixes two security issues in 1.6.10.
|
2015-03-04 21:11:25 +08:00
|
|
|
|
|
|
|
|
Denial-of-service possibility with ``strip_tags()``
|
|
|
|
|
===================================================
|
|
|
|
|
|
|
|
|
|
Last year :func:`~django.utils.html.strip_tags` was changed to work
|
|
|
|
|
iteratively. The problem is that the size of the input it's processing can
|
|
|
|
|
increase on each iteration which results in an infinite loop in
|
|
|
|
|
``strip_tags()``. This issue only affects versions of Python that haven't
|
|
|
|
|
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
|
|
|
|
|
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
|
|
|
|
|
the fix for the Python bug into their packages of earlier versions.
|
|
|
|
|
|
|
|
|
|
To remedy this issue, ``strip_tags()`` will now return the original input if
|
|
|
|
|
it detects the length of the string it's processing increases. Remember that
|
|
|
|
|
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
|
|
|
|
|
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
|
|
|
|
|
escaping it first, for example with :func:`~django.utils.html.escape`.
|
