summaryrefslogtreecommitdiffstats
path: root/meta-python/recipes-devtools/python/python3-django/CVE-2024-41989-0002.patch
blob: 51cf79ffbdcef59b9746c0ac3902cfa76209d55f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
From 4b066bde692078b194709d517b27e55defae787c Mon Sep 17 00:00:00 2001
From: David Wobrock <david.wobrock@gmail.com>
Date: Wed, 18 Jan 2023 22:54:17 +0100
Subject: [PATCH] Fixed #34272 -- Fixed floatformat crash on zero with trailing
 zeros to zero decimal places.

Regression in 08c5a787262c1ae57f6517d4574b54a5fcaad124.

Thanks Andrii Lahuta for the report.

CVE: CVE-2024-41989

Upstream-Status: Backport [https://github.com/django/django/commit/4b066bde692078b194709d517b27e55defae787c]

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
 django/template/defaultfilters.py                     | 2 +-
 tests/template_tests/filter_tests/test_floatformat.py | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py
index 9ca530c..e72593b 100644
--- a/django/template/defaultfilters.py
+++ b/django/template/defaultfilters.py
@@ -140,7 +140,7 @@ def floatformat(text, arg=-1):
     except (ValueError, OverflowError, InvalidOperation):
         return input_val

-    if not m and p < 0:
+    if not m and p <= 0:
         return mark_safe(formats.number_format('%d' % (int(d)), 0))

     exp = Decimal(1).scaleb(-abs(p))
diff --git a/tests/template_tests/filter_tests/test_floatformat.py b/tests/template_tests/filter_tests/test_floatformat.py
index acad66d..538f501 100644
--- a/tests/template_tests/filter_tests/test_floatformat.py
+++ b/tests/template_tests/filter_tests/test_floatformat.py
@@ -65,6 +65,8 @@ class FunctionTests(SimpleTestCase):
         self.assertEqual(floatformat(0, 7), '0.0000000')
         self.assertEqual(floatformat(0, 10), '0.0000000000')
         self.assertEqual(floatformat(0.000000000000000000015, 20), '0.00000000000000000002')
+        self.assertEqual(floatformat("0.00", 0), "0")
+        self.assertEqual(floatformat(Decimal("0.00"), 0), "0")

     def test_infinity(self):
         pos_inf = float(1e30000)
--
2.40.0