December 4, 2024
Django 4.2.17 fixes one security issue with severity “high” and one security issue with severity “moderate” in 4.2.16.
strip_tags()
¶strip_tags()
would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The strip_tags()
method is used to implement the corresponding
striptags
template filter, which was thus also vulnerable.
strip_tags()
now has an upper limit of recursive calls to HTMLParser
before raising a SuspiciousOperation
exception.
Remember that absolutely NO guarantee is provided about the results of
strip_tags()
being HTML safe. So NEVER mark safe the result of a
strip_tags()
call without escaping it first, for example with
django.utils.html.escape()
.
Feb 05, 2025