From 08c5a787262c1ae57f6517d4574b54a5fcaad124 Mon Sep 17 00:00:00 2001 From: Vlastimil Zíma Date: Mon, 24 Oct 2022 12:59:34 +0200 Subject: [PATCH] Fixed #34098 -- Fixed loss of precision for Decimal values in floatformat filter. Regression in 12f7928f5a455e330c0a7f19bc86b37baca12811. CVE: CVE-2024-41989 Upstream-Status: Backport [https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124] Signed-off-by: Soumya Sambu --- django/template/defaultfilters.py | 2 +- tests/template_tests/filter_tests/test_floatformat.py | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py index a1d77f5..9ca530c 100644 --- a/django/template/defaultfilters.py +++ b/django/template/defaultfilters.py @@ -123,7 +123,7 @@ def floatformat(text, arg=-1): of that value. """ try: - input_val = repr(text) + input_val = str(text) d = Decimal(input_val) except InvalidOperation: try: diff --git a/tests/template_tests/filter_tests/test_floatformat.py b/tests/template_tests/filter_tests/test_floatformat.py index cfc3eaf..acad66d 100644 --- a/tests/template_tests/filter_tests/test_floatformat.py +++ b/tests/template_tests/filter_tests/test_floatformat.py @@ -44,6 +44,10 @@ class FunctionTests(SimpleTestCase): self.assertEqual(floatformat(0.12345, 2), '0.12') self.assertEqual(floatformat(Decimal('555.555'), 2), '555.56') self.assertEqual(floatformat(Decimal('09.000')), '9') + self.assertEqual( + floatformat(Decimal("123456.123456789012345678901"), 21), + "123456.123456789012345678901", + ) self.assertEqual(floatformat('foo'), '') self.assertEqual(floatformat(13.1031, 'bar'), '13.1031') self.assertEqual(floatformat(18.125, 2), '18.13') -- 2.40.0