[1.8.x] Fixed an infinite loop possibility in strip_tags().

timgraham · timgraham · commit 5447709a571c · 2015-03-18T19:23:21.000-04:00
This is a security fix; disclosure to follow shortly.
diff --git a/django/utils/html.py b/django/utils/html.py
@@ -183,8 +183,10 @@ def strip_tags(value):
     # is redundant, but helps to reduce number of executions of _strip_once.
     while '<' in value and '>' in value:
         new_value = _strip_once(value)
-        if new_value == value:
-            # _strip_once was not able to detect more tags
+        if len(new_value) >= len(value):
+            # _strip_once was not able to detect more tags or length increased
+            # due to http://bugs.python.org/issue20288
+            # (affects Python 2 < 2.7.7 and Python 3 < 3.3.5)
             break
         value = new_value
     return value
diff --git a/docs/releases/1.6.11.txt b/docs/releases/1.6.11.txt
@@ -5,3 +5,20 @@ Django 1.6.11 release notes
 *March 18, 2015*
 
 Django 1.6.11 fixes two security issues in 1.6.10.
+
+Denial-of-service possibility with ``strip_tags()``
+===================================================
+
+Last year :func:`~django.utils.html.strip_tags`  was changed to work
+iteratively. The problem is that the size of the input it's processing can
+increase on each iteration which results in an infinite loop in
+``strip_tags()``. This issue only affects versions of Python that haven't
+received  `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
+Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
+the fix for the Python bug into their packages of earlier versions.
+
+To remedy this issue, ``strip_tags()`` will now return the original input if
+it detects the length of the string it's processing increases. Remember that
+absolutely NO guarantee is provided about the results of ``strip_tags()`` being
+HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
+escaping it first, for example with :func:`~django.utils.html.escape`.
diff --git a/docs/releases/1.7.7.txt b/docs/releases/1.7.7.txt
@@ -6,6 +6,23 @@ Django 1.7.7 release notes
 
 Django 1.7.7 fixes several bugs and security issues in 1.7.6.
 
+Denial-of-service possibility with ``strip_tags()``
+===================================================
+
+Last year :func:`~django.utils.html.strip_tags`  was changed to work
+iteratively. The problem is that the size of the input it's processing can
+increase on each iteration which results in an infinite loop in
+``strip_tags()``. This issue only affects versions of Python that haven't
+received  `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
+Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
+the fix for the Python bug into their packages of earlier versions.
+
+To remedy this issue, ``strip_tags()`` will now return the original input if
+it detects the length of the string it's processing increases. Remember that
+absolutely NO guarantee is provided about the results of ``strip_tags()`` being
+HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
+escaping it first, for example with :func:`~django.utils.html.escape`.
+
 Bugfixes
 ========
 
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
@@ -82,6 +82,9 @@ def test_strip_tags(self):
             ('a<p a >b</p>c', 'abc'),
             ('d<a:b c:d>e</p>f', 'def'),
             ('<strong>foo</strong><a href="http://example.com">bar</a>', 'foobar'),
+            # caused infinite loop on Pythons not patched with
+            # http://bugs.python.org/issue20288
+            ('&gotcha&#;<>', '&gotcha&#;<>'),
         )
         for value, output in items:
             self.check_output(f, value, output)
