8000 [5.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags(). · django/django@c9731dc · GitHub
[go: up one dir, main page]
Skip to content

Commit c9731dc

Browse files
sarahboycenessita
sarahboyce
authored and
nessita
committed
[5.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b from main.
1 parent ae6b5df commit c9731dc

File tree

5 files changed

+53
-1
lines changed

5 files changed

+53
-1
lines changed

‎django/utils/html.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242

4343
MAX_STRIP_TAGS_DEPTH = 50
4444

45+
# HTML tag that opens but has no closing ">" after 1k+ chars.
46+
long_open_tag_without_closing_re = _lazy_re_compile(r"<[a-zA-Z][^>]{1000,}")
47+
4548

4649
@keep_lazy(SafeString)
4750
def escape(text):
@@ -213,6 +216,9 @@ def _strip_once(value):
213216
def strip_tags(value):
214217
"""Return the given HTML with all tags stripped."""
215218
value = str(value)
219+
for long_open_tag in long_open_tag_without_closing_re.finditer(value):
220+
if long_open_tag.group().count("<") >= MAX_STRIP_TAGS_DEPTH:
221+
raise SuspiciousOperation
216222
# Note: in typical case this loop executes _strip_once twice (the second
217223
# execution does not remove any more tags).
218224
strip_tags_depth = 0

‎docs/releases/4.2.21.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ Django 4.2.21 release notes
77
Django 4.2.21 fixes a security issue with severity "moderate", a data loss bug,
88
and a regression in 4.2.20.
99

10+
CVE-2025-32873: Denial-of-service possibility in ``strip_tags()``
11+
=================================================================
12+
13+
:func:`~django.utils.html.strip_tags` would be slow to evaluate certain inputs
14+
containing large sequences of incomplete HTML tags. This function is used to
15+
implement the :tfilter:`striptags` template filter, which was thus also
16+
vulnerable.
17+
18+
:func:`~django.utils.html.strip_tags` now raises a :exc:`.SuspiciousOperation`
19+
exception if it encounters an unusually large number of unclosed opening tags.
20+
1021
Bugfixes
1122
========
1223

‎docs/releases/5.1.9.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ Django 5.1.9 release notes
77
Django 5.1.9 fixes a security issue with severity "moderate", a data loss bug,
88
and a regression in 5.1.8.
99

10+
CVE-2025-32873: Denial-of-service possibility in ``strip_tags()``
11+
=================================================================
12+
13+
:func:`~django.utils.html.strip_tags` would be slow to evaluate certain inputs
14+
containing large sequences of incomplete HTML tags. This function is used to
15+
implement the :tfilter:`striptags` template filter, which was thus also
16+
vulnerable.
17+
18+
:func:`~django.utils.html.strip_tags` now raises a :exc:`.SuspiciousOperation`
19+
exception if it encounters an unusually large number of unclosed opening tags.
20+
1021
Bugfixes
1122
========
1223

‎docs/releases/5.2.1.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,17 @@ Django 5.2.1 release notes
77
Django 5.2.1 fixes a security issue with severity "moderate" and several bugs
88
in 5.2.
99

10+
CVE-2025-32873: Denial-of-service possibility in ``strip_tags()``
11+
=================================================================
12+
13+
:func:`~django.utils.html.strip_tags` would be slow to evaluate certain inputs
14+
containing large sequences of incomplete HTML tags. This function is used to
15+
implement the :tfilter:`striptags` template filter, which was thus also
16+
vulnerable.
17+
18+
:func:`~django.utils.html.strip_tags` now raises a :exc:`.SuspiciousOperation`
19+
exception if it encounters an unusually large number of unclosed opening tags.
20+
1021
Bugfixes
1122
========
1223

‎tests/utils_tests/test_html.py‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,17 +147,30 @@ def test_strip_tags(self):
147147
("><!" + ("&" * 16000) + "D", "><!" + ("&" * 16000) + "D"),
148148
("X<<<<br>br>br>br>X", "XX"),
149149
("<" * 50 + "a>" * 50, ""),
150+
(">" + "<a" * 500 + "a", ">" + "<a" * 500 + "a"),
151+
("<a" * 49 + "a" * 951, "<a" * 49 + "a" * 951),
152+
("<" + "a" * 1_002, "<" + "a" * 1_002),
150153
)
151154
for value, output in items:
152155
with self.subTest(value=value, output=output):
153156
self.check_output(strip_tags, value, output)
154157
self.check_output(strip_tags, lazystr(value), output)
155158

156-
def test_strip_tags_suspicious_operation(self):
159+
def test_strip_tags_suspicious_operation_max_depth(self):
157160
value = "<" * 51 + "a>" * 51, "<a>"
158161
with self.assertRaises(SuspiciousOperation):
159162
strip_tags(value)
160163

164+
def test_strip_tags_suspicious_operation_large_open_tags(self):
165+
items = [
166+
">" + "<a" * 501,
167+
"<a" * 50 + "a" * 950,
168+
]
169+
for value in items:
170+
with self.subTest(value=value):
171+
with self.assertRaises(SuspiciousOperation):
172+
strip_tags(value)
173+
161174
def test_strip_tags_files(self):
162175
# Test with more lengthy content (also catching performance regressions)
163176
for filename in ("strip_tags1.html", "strip_tags2.txt"):

0 commit comments

Comments
 (0)
0