From dcd974698301a38081c141ccba6dcafa5ed2c80e Mon Sep 17 00:00:00 2001 From: "Panagiotis H.M. Issaris" Date: Wed, 22 Feb 2023 20:46:16 +0100 Subject: [PATCH] Fixed #34363 -- Fixed floatformat crash on zero with trailing zeros. Regression in 08c5a787262c1ae57f6517d4574b54a5fcaad124. Follow up to 4b066bde692078b194709d517b27e55defae787c. CVE: CVE-2024-41989 Upstream-Status: Backport [https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e] Signed-off-by: Soumya Sambu --- django/template/defaultfilters.py | 3 ++- tests/template_tests/filter_tests/test_floatformat.py | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py index e72593b..1aba321 100644 --- a/django/template/defaultfilters.py +++ b/django/template/defaultfilters.py @@ -2,7 +2,7 @@ import random as random_module import re import types -from decimal import ROUND_HALF_UP, Context, Decimal, InvalidOperation +from decimal import ROUND_HALF_UP, Context, Decimal, InvalidOperation, getcontext from functools import wraps from operator import itemgetter from pprint import pformat @@ -149,6 +149,7 @@ def floatformat(text, arg=-1): units = len(tupl[1]) units += -tupl[2] if m else tupl[2] prec = abs(p) + units + 1 + prec = max(getcontext().prec, prec) # Avoid conversion to scientific notation by accessing `sign`, `digits`, # and `exponent` from Decimal.as_tuple() directly. diff --git a/tests/template_tests/filter_tests/test_floatformat.py b/tests/template_tests/filter_tests/test_floatformat.py index 538f501..413ba4b 100644 --- a/tests/template_tests/filter_tests/test_floatformat.py +++ b/tests/template_tests/filter_tests/test_floatformat.py @@ -67,6 +67,10 @@ class FunctionTests(SimpleTestCase): self.assertEqual(floatformat(0.000000000000000000015, 20), '0.00000000000000000002') self.assertEqual(floatformat("0.00", 0), "0") self.assertEqual(floatformat(Decimal("0.00"), 0), "0") + self.assertEqual(floatformat("0.0000", 2), "0.00") + self.assertEqual(floatformat(Decimal("0.0000"), 2), "0.00") + self.assertEqual(floatformat("0.000000", 4), "0.0000") + self.assertEqual(floatformat(Decimal("0.000000"), 4), "0.0000") def test_infinity(self): pos_inf = float(1e30000) -- 2.40.0