From 9d656ea51d9ea7105c0c0785783ac29d426a7d25 Mon Sep 17 00:00:00 2001
From: Adam Johnson <me@adamj.eu>
Date: Fri, 2 Sep 2022 09:44:05 +0100
Subject: [PATCH] [4.1.x] Fixed CVE-2022-41323 -- Prevented locales being
 interpreted as regular expressions.

Thanks to Benjamin Balder Bach for the report.
---
 django/urls/resolvers.py     | 2 +-
 docs/releases/3.2.16.txt     | 6 +++++-
 docs/releases/4.0.8.txt      | 6 +++++-
 docs/releases/4.1.2.txt      | 6 ++++++
 tests/i18n/patterns/tests.py | 6 ++++++
 5 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/django/urls/resolvers.py b/django/urls/resolvers.py
index 9f42e2738c..9a22b0d87d 100644
--- a/django/urls/resolvers.py
+++ b/django/urls/resolvers.py
@@ -346,7 +346,7 @@ class LocalePrefixPattern:
     @property
     def regex(self):
         # This is only used by reverse() and cached in _reverse_dict.
-        return re.compile(self.language_prefix)
+        return re.compile(re.escape(self.language_prefix))
 
     @property
     def language_prefix(self):
diff --git a/docs/releases/3.2.16.txt b/docs/releases/3.2.16.txt
index 3769d0837c..da0a6c4ed4 100644
--- a/docs/releases/3.2.16.txt
+++ b/docs/releases/3.2.16.txt
@@ -6,4 +6,8 @@ Django 3.2.16 release notes
 
 Django 3.2.16 fixes a security issue with severity "medium" in 3.2.15.
 
-...
+CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs
+===================================================================================
+
+Internationalized URLs were subject to potential denial of service attack via
+the locale parameter.
diff --git a/docs/releases/4.0.8.txt b/docs/releases/4.0.8.txt
index 602fe0a76a..b057eaa1ea 100644
--- a/docs/releases/4.0.8.txt
+++ b/docs/releases/4.0.8.txt
@@ -6,4 +6,8 @@ Django 4.0.8 release notes
 
 Django 4.0.8 fixes a security issue with severity "medium" in 4.0.7.
 
-...
+CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs
+===================================================================================
+
+Internationalized URLs were subject to potential denial of service attack via
+the locale parameter.
diff --git a/docs/releases/4.1.2.txt b/docs/releases/4.1.2.txt
index 1dddbf44a0..2ee6fe0f5c 100644
--- a/docs/releases/4.1.2.txt
+++ b/docs/releases/4.1.2.txt
@@ -7,6 +7,12 @@ Django 4.1.2 release notes
 Django 4.1.2 fixes a security issue with severity "medium" and several bugs in
 4.1.1.
 
+CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs
+===================================================================================
+
+Internationalized URLs were subject to potential denial of service attack via
+the locale parameter.
+
 Bugfixes
 ========
 
diff --git a/tests/i18n/patterns/tests.py b/tests/i18n/patterns/tests.py
index 43d95ff668..0b104ff548 100644
--- a/tests/i18n/patterns/tests.py
+++ b/tests/i18n/patterns/tests.py
@@ -215,6 +215,12 @@ class URLTranslationTests(URLTestCaseBase):
                     expected_link,
                 )
 
+    def test_locale_not_interepreted_as_regex(self):
+        with translation.override("e("):
+            # Would previously error:
+            # re.error: missing ), unterminated subpattern at position 1
+            reverse("users")
+
 
 class URLNamespaceTests(URLTestCaseBase):
     """