Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

Thanks to Guido Vranken for initial report.
This commit is contained in:
Florian Apolloner 2019-07-15 12:00:06 +02:00 committed by Carlton Gibson
parent 7f65974f82
commit 4b78420d25
5 changed files with 55 additions and 2 deletions

View File

@ -181,8 +181,8 @@ def strip_tags(value):
value = str(value) value = str(value)
while '<' in value and '>' in value: while '<' in value and '>' in value:
new_value = _strip_once(value) new_value = _strip_once(value)
if len(new_value) >= len(value): if value.count('<') == new_value.count('<'):
# _strip_once was not able to detect more tags # _strip_once wasn't able to detect more tags.
break break
value = new_value value = new_value
return value return value

View File

@ -19,3 +19,20 @@ filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in order to The regular expressions used by ``Truncator`` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output. now at times be included in the truncated output.
CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
=================================================================
Due to the behavior of the underlying ``HTMLParser``,
:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.
``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.
Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.

View File

@ -19,3 +19,20 @@ filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in order to The regular expressions used by ``Truncator`` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output. now at times be included in the truncated output.
CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
=================================================================
Due to the behavior of the underlying ``HTMLParser``,
:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.
``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.
Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.

View File

@ -20,6 +20,23 @@ The regular expressions used by ``Truncator`` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output. now at times be included in the truncated output.
CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
=================================================================
Due to the behavior of the underlying ``HTMLParser``,
:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.
``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.
Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.
Bugfixes Bugfixes
======== ========

View File

@ -90,6 +90,8 @@ class TestUtilsHtml(SimpleTestCase):
('&gotcha&#;<>', '&gotcha&#;<>'), ('&gotcha&#;<>', '&gotcha&#;<>'),
('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'), ('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'),
('<script>alert()</script>&h', 'alert()h'), ('<script>alert()</script>&h', 'alert()h'),
('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),
('X<<<<br>br>br>br>X', 'XX'),
) )
for value, output in items: for value, output in items:
with self.subTest(value=value, output=output): with self.subTest(value=value, output=output):