1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
From dcd974698301a38081c141ccba6dcafa5ed2c80e Mon Sep 17 00:00:00 2001
From: "Panagiotis H.M. Issaris" <takis@issaris.com>
Date: Wed, 22 Feb 2023 20:46:16 +0100
Subject: [PATCH] Fixed #34363 -- Fixed floatformat crash on zero with trailing
zeros.
Regression in 08c5a787262c1ae57f6517d4574b54a5fcaad124.
Follow up to 4b066bde692078b194709d517b27e55defae787c.
CVE: CVE-2024-41989
Upstream-Status: Backport [https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e]
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
django/template/defaultfilters.py | 3 ++-
tests/template_tests/filter_tests/test_floatformat.py | 4 ++++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/django/template/defaultfilters.py b/django/template/defaultfilters.py
index e72593b..1aba321 100644
--- a/django/template/defaultfilters.py
+++ b/django/template/defaultfilters.py
@@ -2,7 +2,7 @@
import random as random_module
import re
import types
-from decimal import ROUND_HALF_UP, Context, Decimal, InvalidOperation
+from decimal import ROUND_HALF_UP, Context, Decimal, InvalidOperation, getcontext
from functools import wraps
from operator import itemgetter
from pprint import pformat
@@ -149,6 +149,7 @@ def floatformat(text, arg=-1):
units = len(tupl[1])
units += -tupl[2] if m else tupl[2]
prec = abs(p) + units + 1
+ prec = max(getcontext().prec, prec)
# Avoid conversion to scientific notation by accessing `sign`, `digits`,
# and `exponent` from Decimal.as_tuple() directly.
diff --git a/tests/template_tests/filter_tests/test_floatformat.py b/tests/template_tests/filter_tests/test_floatformat.py
index 538f501..413ba4b 100644
--- a/tests/template_tests/filter_tests/test_floatformat.py
+++ b/tests/template_tests/filter_tests/test_floatformat.py
@@ -67,6 +67,10 @@ class FunctionTests(SimpleTestCase):
self.assertEqual(floatformat(0.000000000000000000015, 20), '0.00000000000000000002')
self.assertEqual(floatformat("0.00", 0), "0")
self.assertEqual(floatformat(Decimal("0.00"), 0), "0")
+ self.assertEqual(floatformat("0.0000", 2), "0.00")
+ self.assertEqual(floatformat(Decimal("0.0000"), 2), "0.00")
+ self.assertEqual(floatformat("0.000000", 4), "0.0000")
+ self.assertEqual(floatformat(Decimal("0.000000"), 4), "0.0000")
def test_infinity(self):
pos_inf = float(1e30000)
--
2.40.0
|
