[2.2.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.

apollo13 · carltongibson · commit e34f3c0e9ee5 · 2019-07-29T11:06:54.000+02:00
Thanks to Guido Vranken for initial report.
diff --git a/django/utils/html.py b/django/utils/html.py
@@ -187,8 +187,8 @@ def strip_tags(value):
     value = str(value)
     while '<' in value and '>' in value:
         new_value = _strip_once(value)
-        if len(new_value) >= len(value):
-            # _strip_once was not able to detect more tags
+        if value.count('<') == new_value.count('<'):
+            # _strip_once wasn't able to detect more tags.
             break
         value = new_value
     return value
diff --git a/docs/releases/1.11.23.txt b/docs/releases/1.11.23.txt
@@ -19,3 +19,20 @@ filters, which were thus vulnerable.
 The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
+
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
diff --git a/docs/releases/2.1.11.txt b/docs/releases/2.1.11.txt
@@ -19,3 +19,20 @@ filters, which were thus vulnerable.
 The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
+
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
diff --git a/docs/releases/2.2.4.txt b/docs/releases/2.2.4.txt
@@ -20,6 +20,23 @@ The regular expressions used by ``Truncator`` have been simplified in order to
 avoid potential backtracking issues. As a consequence, trailing punctuation may
 now at times be included in the truncated output.
 
+CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
+=================================================================
+
+Due to the behavior of the underlying ``HTMLParser``,
+:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
+certain inputs containing large sequences of nested incomplete HTML entities.
+The ``strip_tags()`` method is used to implement the corresponding
+:tfilter:`striptags` template filter, which was thus also vulnerable.
+
+``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
+removing tags, but necessarily incomplete HTML entities, stops being made.
+
+Remember that absolutely NO guarantee is provided about the results of
+``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
+``strip_tags()`` call without escaping it first, for example with
+:func:`django.utils.html.escape`.
+
 Bugfixes
 ========
 
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
@@ -88,6 +88,8 @@ def test_strip_tags(self):
             ('&gotcha&#;<>', '&gotcha&#;<>'),
             ('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'),
             ('<script>alert()</script>&h', 'alert()h'),
+            ('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),
+            ('X<<<<br>br>br>br>X', 'XX'),
         )
         for value, output in items:
             with self.subTest(value=value, output=output):

Original file line number	Diff line number	Diff line change
`@@ -88,6 +88,8 @@ def test_strip_tags(self):`
`88`	`88`	`('&gotcha&#;<>', '&gotcha&#;<>'),`
`89`	`89`	`('<sc<!-- -->ript>test<<!-- -->/script>', 'ript>test'),`
`90`	`90`	`('<script>alert()</script>&h', 'alert()h'),`
	`91`	`+ ('><!' + ('&' * 16000) + 'D', '><!' + ('&' * 16000) + 'D'),`
	`92`	`+ ('X<<<<br>br>br>br>X', 'XX'),`
`91`	`93`	`)`
`92`	`94`	`for value, output in items:`
`93`	`95`	`with self.subTest(value=value, output=output):`