{"title":"Django 1.7.7 release notes","version":"dev","locale":"en","docname":"releases/1.7.7","url":"/en/dev/releases/1.7.7/","canonical":"https://djangodocs.dev/en/dev/releases/1.7.7/","summary":"Django 1.7.7 fixes several bugs and security issues in 1.7.6. Last year strip_tags() was changed to work iteratively.","html":"

Django 1.7.7 release notesLink to this heading#

\n

March 18, 2015

\n

Django 1.7.7 fixes several bugs and security issues in 1.7.6.

\n
\n

Denial-of-service possibility with strip_tags()Link to this heading#

\n

Last year strip_tags() was changed to work\niteratively. The problem is that the size of the input it’s processing can\nincrease on each iteration which results in an infinite loop in\nstrip_tags(). This issue only affects versions of Python that haven’t\nreceived a bugfix in HTMLParser; namely Python < 2.7.7 and\n3.3.5. Some operating system vendors have also backported the fix for the\nPython bug into their packages of earlier versions.

\n

To remedy this issue, strip_tags() will now return the original input if\nit detects the length of the string it’s processing increases. Remember that\nabsolutely NO guarantee is provided about the results of strip_tags() being\nHTML safe. So NEVER mark safe the result of a strip_tags() call without\nescaping it first, for example with escape().

\n
\n
\n

Mitigated possible XSS attack via user-supplied redirect URLsLink to this heading#

\n

Django relies on user input in some cases (e.g.\ndjango.contrib.auth.views.login() and i18n)\nto redirect the user to an “on success” URL. The security checks for these\nredirects (namely django.utils.http.is_safe_url()) accepted URLs with\nleading control characters and so considered URLs like \\x08javascript:...\nsafe. This issue doesn’t affect Django currently, since we only put this URL\ninto the Location response header and browsers seem to ignore JavaScript\nthere. Browsers we tested also treat URLs prefixed with control characters such\nas %08//example.com as relative paths so redirection to an unsafe target\nisn’t a problem either.

\n

However, if a developer relies on is_safe_url() to\nprovide safe redirect targets and puts such a URL into a link, they could\nsuffer from an XSS attack as some browsers such as Google Chrome ignore control\ncharacters at the start of a URL in an anchor href.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-1-7-7-release-notes","toc":[{"title":"Denial-of-service possibility with strip_tags()","anchor":"denial-of-service-possibility-with-strip-tags","children":[]},{"title":"Mitigated possible XSS attack via user-supplied redirect URLs","anchor":"mitigated-possible-xss-attack-via-user-supplied-redirect-urls","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.7.8","title":"Django 1.7.8 release notes","url":"/en/dev/releases/1.7.8/"},"next":{"docname":"releases/1.7.6","title":"Django 1.7.6 release notes","url":"/en/dev/releases/1.7.6/"},"formats":{"html":"/en/dev/releases/1.7.7/","markdown":"/en/dev/releases/1.7.7.md","json":"/en/dev/releases/1.7.7.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.7.7.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.7.7/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}