diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2019-07-19 17:04:53 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-08-01 09:24:54 +0200 |
| commit | 76ed1c49f804d409cfc2911a890c78584db3c76e (patch) | |
| tree | 5ef2a16f5ed2daff97c3d1c40e0d6c7134edfb30 /django/utils/encoding.py | |
| parent | 7deeabc7c7526786df6894429ce89a9c4b614086 (diff) | |
| download | django-76ed1c49f804d409cfc2911a890c78584db3c76e.tar.gz | |
Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri().
Thanks to Guido Vranken for initial report.
Diffstat (limited to 'django/utils/encoding.py')
| -rw-r--r-- | django/utils/encoding.py | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/django/utils/encoding.py b/django/utils/encoding.py index 2e2ad44e31..0721d516c4 100644 --- a/django/utils/encoding.py +++ b/django/utils/encoding.py @@ -229,13 +229,16 @@ def repercent_broken_unicode(path): repercent-encode any octet produced that is not part of a strictly legal UTF-8 octet sequence. """ - try: - path.decode() - except UnicodeDecodeError as e: - repercent = quote(path[e.start:e.end], safe=b"/#%[]=:;$&()+,!?*@'~") - path = repercent_broken_unicode( - path[:e.start] + force_bytes(repercent) + path[e.end:]) - return path + while True: + try: + path.decode() + except UnicodeDecodeError as e: + # CVE-2019-14235: A recursion shouldn't be used since the exception + # handling uses massive amounts of memory + repercent = quote(path[e.start:e.end], safe=b"/#%[]=:;$&()+,!?*@'~") + path = path[:e.start] + force_bytes(repercent) + path[e.end:] + else: + return path def filepath_to_uri(path): |