Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
python-Django.18123
CVE-2023-43665.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2023-43665.patch of Package python-Django.18123
Index: Django-2.2.28/django/utils/text.py =================================================================== --- Django-2.2.28.orig/django/utils/text.py +++ Django-2.2.28/django/utils/text.py @@ -57,7 +57,14 @@ def wrap(text, width): class Truncator(SimpleLazyObject): """ An object used to truncate text, either by characters or words. + + When truncating HTML text (either chars or words), input will be limited to + at most `MAX_LENGTH_HTML` characters. """ + + # 5 million characters are approximately 4000 text pages or 3 web pages. + MAX_LENGTH_HTML = 5_000_000 + def __init__(self, text): super().__init__(lambda: str(text)) @@ -154,6 +161,11 @@ class Truncator(SimpleLazyObject): if words and length <= 0: return '' + size_limited = False + if len(text) > self.MAX_LENGTH_HTML: + text = text[: self.MAX_LENGTH_HTML] + size_limited = True + html4_singlets = ( 'br', 'col', 'link', 'base', 'img', 'param', 'area', 'hr', 'input' @@ -203,10 +215,14 @@ class Truncator(SimpleLazyObject): # Add it to the start of the open tags list open_tags.insert(0, tagname) + truncate_text = self.add_truncation_text("", truncate) + if current_len <= length: + if size_limited and truncate_text: + text += truncate_text return text + out = text[:end_text_pos] - truncate_text = self.add_truncation_text('', truncate) if truncate_text: out += truncate_text # Close any tags still open Index: Django-2.2.28/tests/utils_tests/test_text.py =================================================================== --- Django-2.2.28.orig/tests/utils_tests/test_text.py +++ Django-2.2.28/tests/utils_tests/test_text.py @@ -1,5 +1,6 @@ import json import sys +from unittest.mock import patch from django.core.exceptions import SuspiciousFileOperation from django.test import SimpleTestCase @@ -87,11 +88,17 @@ class TestUtilsText(SimpleTestCase): # lazy strings are handled correctly self.assertEqual(text.Truncator(lazystr('The quick brown fox')).chars(10), 'The quick…') - def test_truncate_chars_html(self): + @patch("django.utils.text.Truncator.MAX_LENGTH_HTML", 10_000) + def test_truncate_chars_html_size_limit(self): + max_len = text.Truncator.MAX_LENGTH_HTML + bigger_len = text.Truncator.MAX_LENGTH_HTML + 1 + valid_html = "<p>Joel is a slug</p>" # 14 chars perf_test_values = [ - (('</a' + '\t' * 50000) + '//>', None), - ('&' * 50000, '&' * 9 + '…'), - ('_X<<<<<<<<<<<>', None), + ("</a" + "\t" * (max_len - 6) + "//>", None), + ("</p" + "\t" * bigger_len + "//>", "</p" + "\t" * 6 + "…"), + ("&" * bigger_len, "&" * 9 + "…"), + ("_X<<<<<<<<<<<>", None), + (valid_html * bigger_len, "<p>Joel is a…</p>"), # 10 chars ] for value, expected in perf_test_values: with self.subTest(value=value): @@ -149,15 +156,25 @@ class TestUtilsText(SimpleTestCase): truncator = text.Truncator('<p>I <3 python, what about you?</p>') self.assertEqual('<p>I <3 python,…</p>', truncator.words(3, html=True)) + @patch("django.utils.text.Truncator.MAX_LENGTH_HTML", 10_000) + def test_truncate_words_html_size_limit(self): + max_len = text.Truncator.MAX_LENGTH_HTML + bigger_len = text.Truncator.MAX_LENGTH_HTML + 1 + valid_html = "<p>Joel is a slug</p>" # 4 words perf_test_values = [ - ('</a' + '\t' * 50000) + '//>', - '&' * 50000, - '_X<<<<<<<<<<<>', + ("</a" + "\t" * (max_len - 6) + "//>", None), + ("</p" + "\t" * bigger_len + "//>", "</p" + "\t" * (max_len - 3) + "…"), + ("&" * max_len, None), # no change + ("&" * bigger_len, "&" * max_len + "…"), + ("_X<<<<<<<<<<<>", None), + (valid_html * bigger_len, valid_html * 12 + "<p>Joel is…</p>"), # 50 words ] - for value in perf_test_values: + for value, expected in perf_test_values: with self.subTest(value=value): truncator = text.Truncator(value) - self.assertEqual(value, truncator.words(50, html=True)) + self.assertEqual( + expected if expected else value, truncator.words(50, html=True) + ) def test_wrap(self): digits = '1234 67 9'
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor