티스토리 수익 글 보기

티스토리 수익 글 보기

Fixed CVE-2025-64458 — Mitigated potential DoS in HttpResponseRedire… · django/django@c880530 · GitHub
Skip to content

Commit c880530

Browse files
jacobtylerwallsnessita
jacobtylerwalls
authored and
nessita
committed
Fixed CVE-2025-64458 — Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.
Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297.
1 parent 7456494 commit c880530

File tree

5 files changed

+37
–4
lines changed

5 files changed

+37
–4
lines changed

‎django/http/response.py‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
from django.utils.datastructures import CaseInsensitiveMapping
2323
from django.utils.encoding import iri_to_uri
2424
from django.utils.functional import cached_property
25-
from django.utils.http import content_disposition_header, http_date
25+
from django.utils.http import MAX_URL_LENGTH, content_disposition_header, http_date
2626
from django.utils.regex_helper import _lazy_re_compile
2727

2828
_charset_from_content_type_re = _lazy_re_compile(
@@ -631,7 +631,12 @@ class HttpResponseRedirectBase(HttpResponse):
631631
def __init__(self, redirect_to, preserve_request=False, *args, **kwargs):
632632
super().__init__(*args, **kwargs)
633633
self["Location"] = iri_to_uri(redirect_to)
634-
parsed = urlsplit(str(redirect_to))
634+
redirect_to_str = str(redirect_to)
635+
if len(redirect_to_str) > MAX_URL_LENGTH:
636+
raise DisallowedRedirect(
637+
f"Unsafe redirect exceeding {MAX_URL_LENGTH} characters"
638+
)
639+
parsed = urlsplit(redirect_to_str)
635640
if preserve_request:
636641
self.status_code = self.status_code_preserve_request
637642
if parsed.scheme and parsed.scheme not in self.allowed_schemes:

‎docs/releases/4.2.26.txt‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,12 @@ Django 4.2.26 release notes
77
Django 4.2.26 fixes one security issue with severity "high" and one security
88
issue with severity "moderate" in 4.2.25.
99

10-
...
10+
CVE-2025-64458: Potential denial-of-service vulnerability in ``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
11+
======================================================================================================================================
12+
13+
Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
14+
Windows. As a consequence, :class:`~django.http.HttpResponseRedirect`,
15+
:class:`~django.http.HttpResponsePermanentRedirect`, and the shortcut
16+
:func:`redirect() <django.shortcuts.redirect>` were subject to a potential
17+
denial-of-service attack via certain inputs with a very large number of Unicode
18+
characters (follow up to :cve:`2025-27556`).

‎docs/releases/5.1.14.txt‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,12 @@ Django 5.1.14 release notes
77
Django 5.1.14 fixes one security issue with severity "high" and one security
88
issue with severity "moderate" in 5.1.13.
99

10-
...
10+
CVE-2025-64458: Potential denial-of-service vulnerability in ``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
11+
======================================================================================================================================
12+
13+
Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
14+
Windows. As a consequence, :class:`~django.http.HttpResponseRedirect`,
15+
:class:`~django.http.HttpResponsePermanentRedirect`, and the shortcut
16+
:func:`redirect() <django.shortcuts.redirect>` were subject to a potential
17+
denial-of-service attack via certain inputs with a very large number of Unicode
18+
characters (follow up to :cve:`2025-27556`).

‎docs/releases/5.2.8.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,16 @@ Django 5.2.8 fixes one security issue with severity "high", one security issue
88
with severity "moderate", and several bugs in 5.2.7. It also adds compatibility
99
with Python 3.14.
1010

11+
CVE-2025-64458: Potential denial-of-service vulnerability in ``HttpResponseRedirect`` and ``HttpResponsePermanentRedirect`` on Windows
12+
======================================================================================================================================
13+
14+
Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
15+
Windows. As a consequence, :class:`~django.http.HttpResponseRedirect`,
16+
:class:`~django.http.HttpResponsePermanentRedirect`, and the shortcut
17+
:func:`redirect() <django.shortcuts.redirect>` were subject to a potential
18+
denial-of-service attack via certain inputs with a very large number of Unicode
19+
characters (follow up to :cve:`2025-27556`).
20+
1121
Bugfixes
1222
========
1323

‎tests/httpwrappers/tests.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
)
2525
from django.test import SimpleTestCase
2626
from django.utils.functional import lazystr
27+
from django.utils.http import MAX_URL_LENGTH
2728

2829

2930
class QueryDictTests(SimpleTestCase):
@@ -490,6 +491,7 @@ def test_unsafe_redirect(self):
490491
'data:text/html,<script>window.alert("xss")</script>',
491492
"mailto:test@example.com",
492493
"file:///etc/passwd",
494+
"é" * (MAX_URL_LENGTH + 1),
493495
]
494496
for url in bad_urls:
495497
with self.assertRaises(DisallowedRedirect):

0 commit comments

Comments
 (0)