| 12345678910111213141516171819202122232425262728293031323334353637383940414243 |
- ===========================
- Django 1.6.11 release notes
- ===========================
- *March 18, 2015*
- Django 1.6.11 fixes two security issues in 1.6.10.
- Denial-of-service possibility with ``strip_tags()``
- ===================================================
- Last year :func:`~django.utils.html.strip_tags` was changed to work
- iteratively. The problem is that the size of the input it's processing can
- increase on each iteration which results in an infinite loop in
- ``strip_tags()``. This issue only affects versions of Python that haven't
- received `a bugfix in HTMLParser <https://bugs.python.org/issue20288>`_; namely
- Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
- the fix for the Python bug into their packages of earlier versions.
- To remedy this issue, ``strip_tags()`` will now return the original input if
- it detects the length of the string it's processing increases. Remember that
- absolutely NO guarantee is provided about the results of ``strip_tags()`` being
- HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
- escaping it first, for example with :func:`~django.utils.html.escape`.
- Mitigated possible XSS attack via user-supplied redirect URLs
- =============================================================
- Django relies on user input in some cases (e.g.
- :func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
- to redirect the user to an "on success" URL. The security checks for these
- redirects (namely ``django.utils.http.is_safe_url()``) accepted URLs with
- leading control characters and so considered URLs like ``\x08javascript:...``
- safe. This issue doesn't affect Django currently, since we only put this URL
- into the ``Location`` response header and browsers seem to ignore JavaScript
- there. Browsers we tested also treat URLs prefixed with control characters such
- as ``%08//example.com`` as relative paths so redirection to an unsafe target
- isn't a problem either.
- However, if a developer relies on ``is_safe_url()`` to
- provide safe redirect targets and puts such a URL into a link, they could
- suffer from an XSS attack as some browsers such as Google Chrome ignore control
- characters at the start of a URL in an anchor ``href``.
|
