From d0a82e26a74940bf0c78204933c3bdd6a283eb88 Mon Sep 17 00:00:00 2001
From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Date: Thu, 18 Jul 2024 13:19:34 +0200
Subject: [PATCH] [4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in
 urlize and urlizetrunc template filters.

Thanks to MProgrammer for the report.

CVE: CVE-2024-41990

Upstream-Status: Backport [https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88]

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
 django/utils/html.py           | 18 ++++++++----------
 tests/utils_tests/test_html.py |  2 ++
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/django/utils/html.py b/django/utils/html.py
index f1b74ab..84e157d 100644
--- a/django/utils/html.py
+++ b/django/utils/html.py
@@ -315,7 +315,11 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):
                         trimmed_something = True
                         counts[closing] -= strip

-            rstripped = middle.rstrip(trailing_punctuation_chars_no_semicolon())
+            amp = middle.rfind("&")
+            if amp == -1:
+                rstripped = middle.rstrip(TRAILING_PUNCTUATION_CHARS)
+            else:
+                rstripped = middle.rstrip(trailing_punctuation_chars_no_semicolon())
             if rstripped != middle:
                 trail = middle[len(rstripped) :] + trail
                 middle = rstripped
@@ -323,15 +327,9 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):

             if trailing_punctuation_chars_has_semicolon() and middle.endswith(";"):
                 # Only strip if not part of an HTML entity.
-                amp = middle.rfind("&")
-                if amp == -1:
-                    can_strip = True
-                else:
-                    potential_entity = middle[amp:]
-                    escaped = unescape(potential_entity)
-                    can_strip = (escaped == potential_entity) or escaped.endswith(";")
-
-                if can_strip:
+                potential_entity = middle[amp:]
+                escaped = unescape(potential_entity)
+                if escaped == potential_entity or escaped.endswith(";"):
                     rstripped = middle.rstrip(";")
                     amount_stripped = len(middle) - len(rstripped)
                     if amp > -1 and amount_stripped > 1:
diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
index 715c1c6..5abab8d 100644
--- a/tests/utils_tests/test_html.py
+++ b/tests/utils_tests/test_html.py
@@ -274,6 +274,8 @@ class TestUtilsHtml(SimpleTestCase):
             "[(" * 100_000 + ":" + ")]" * 100_000,
             "([[" * 100_000 + ":" + "]])" * 100_000,
             "&:" + ";" * 100_000,
+            "&.;" * 100_000,
+            ".;" * 100_000,
         )
         for value in tests:
             with self.subTest(value=value):
--
2.40.0