!96 [sync] PR-90: Fix CVE-2024-24680

From: @openeuler-sync-bot 
Reviewed-by: @cherry530 
Signed-off-by: @cherry530

CVE-2024-24680.patch

@@ -0,0 +1,204 @@
+From c1171ffbd570db90ca206c30f8e2b9f691243820 Mon Sep 17 00:00:00 2001
+From: Adam Johnson <me@adamj.eu>
+Date: Mon, 22 Jan 2024 13:21:13 +0000
+Subject: [PATCH] [3.2.x] Fixed CVE-2024-24680 -- Mitigated potential DoS in
+ intcomma template filter.
+
+Thanks Seokchan Yoon for the report.
+
+Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
+Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
+Co-authored-by: Shai Berger <shai@platonix.com>
+---
+ .../contrib/humanize/templatetags/humanize.py |  13 +-
+ tests/humanize_tests/tests.py                 | 140 ++++++++++++++++--
+ 2 files changed, 135 insertions(+), 18 deletions(-)
+
+diff --git a/django/contrib/humanize/templatetags/humanize.py b/django/contrib/humanize/templatetags/humanize.py
+index 753a0d9..238aaf2 100644
+--- a/django/contrib/humanize/templatetags/humanize.py
++++ b/django/contrib/humanize/templatetags/humanize.py
+@@ -70,12 +70,13 @@ def intcomma(value, use_l10n=True):
+             return intcomma(value, False)
+         else:
+             return number_format(value, use_l10n=True, force_grouping=True)
+-    orig = str(value)
+-    new = re.sub(r"^(-?\d+)(\d{3})", r'\g<1>,\g<2>', orig)
+-    if orig == new:
+-        return new
+-    else:
+-        return intcomma(new, use_l10n)
++    result = str(value)
++    match = re.match(r"-?\d+", result)
++    if match:
++        prefix = match[0]
++        prefix_with_commas = re.sub(r"\d{3}", r"\g<0>,", prefix[::-1])[::-1]
++        result = prefix_with_commas + result[len(prefix) :]
++    return result
+ 
+ 
+ # A tuple of standard large number to their converters
+diff --git a/tests/humanize_tests/tests.py b/tests/humanize_tests/tests.py
+index a0d16bb..3c22787 100644
+--- a/tests/humanize_tests/tests.py
++++ b/tests/humanize_tests/tests.py
+@@ -66,28 +66,144 @@ class HumanizeTests(SimpleTestCase):
+ 
+     def test_intcomma(self):
+         test_list = (
+-            100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
+-            '10123', '10311', '1000000', '1234567.1234567',
+-            Decimal('1234567.1234567'), None,
++            100,
++            -100,
++            1000,
++            -1000,
++            10123,
++            -10123,
++            10311,
++            -10311,
++            1000000,
++            -1000000,
++            1234567.25,
++            -1234567.25,
++            "100",
++            "-100",
++            "1000",
++            "-1000",
++            "10123",
++            "-10123",
++            "10311",
++            "-10311",
++            "1000000",
++            "-1000000",
++            "1234567.1234567",
++            "-1234567.1234567",
++            Decimal("1234567.1234567"),
++            Decimal("-1234567.1234567"),
++            None,
++            "１２３４５６７",
++            "-１２３４５６７",
++            "１２３４５６７.１２",
++            "-１２３４５６７.１２",
++            "the quick brown fox jumped over the lazy dog",
+         )
+         result_list = (
+-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
+-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
+-            '1,234,567.1234567', None,
++            "100",
++            "-100",
++            "1,000",
++            "-1,000",
++            "10,123",
++            "-10,123",
++            "10,311",
++            "-10,311",
++            "1,000,000",
++            "-1,000,000",
++            "1,234,567.25",
++            "-1,234,567.25",
++            "100",
++            "-100",
++            "1,000",
++            "-1,000",
++            "10,123",
++            "-10,123",
++            "10,311",
++            "-10,311",
++            "1,000,000",
++            "-1,000,000",
++            "1,234,567.1234567",
++            "-1,234,567.1234567",
++            "1,234,567.1234567",
++            "-1,234,567.1234567",
++            None,
++            "1,234,567",
++            "-1,234,567",
++            "１,２３４,５６７.１２",
++            "-１,２３４,５６７.１２",
++            "the quick brown fox jumped over the lazy dog",
+         )
+         with translation.override('en'):
+             self.humanize_tester(test_list, result_list, 'intcomma')
+ 
+     def test_l10n_intcomma(self):
+         test_list = (
+-            100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
+-            '10123', '10311', '1000000', '1234567.1234567',
+-            Decimal('1234567.1234567'), None,
++            100,
++            -100,
++            1000,
++            -1000,
++            10123,
++            -10123,
++            10311,
++            -10311,
++            1000000,
++            -1000000,
++            1234567.25,
++            -1234567.25,
++            "100",
++            "-100",
++            "1000",
++            "-1000",
++            "10123",
++            "-10123",
++            "10311",
++            "-10311",
++            "1000000",
++            "-1000000",
++            "1234567.1234567",
++            "-1234567.1234567",
++            Decimal("1234567.1234567"),
++            -Decimal("1234567.1234567"),
++            None,
++            "１２３４５６７",
++            "-１２３４５６７",
++            "１２３４５６７.１２",
++            "-１２３４５６７.１２",
++            "the quick brown fox jumped over the lazy dog",
+         )
+         result_list = (
+-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
+-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
+-            '1,234,567.1234567', None,
++            "100",
++            "-100",
++            "1,000",
++            "-1,000",
++            "10,123",
++            "-10,123",
++            "10,311",
++            "-10,311",
++            "1,000,000",
++            "-1,000,000",
++            "1,234,567.25",
++            "-1,234,567.25",
++            "100",
++            "-100",
++            "1,000",
++            "-1,000",
++            "10,123",
++            "-10,123",
++            "10,311",
++            "-10,311",
++            "1,000,000",
++            "-1,000,000",
++            "1,234,567.1234567",
++            "-1,234,567.1234567",
++            "1,234,567.1234567",
++            "-1,234,567.1234567",
++            None,
++            "1,234,567",
++            "-1,234,567",
++            "１,２３４,５６７.１２",
++            "-１,２３４,５６７.１２",
++            "the quick brown fox jumped over the lazy dog",
+         )
+         with self.settings(USE_L10N=True, USE_THOUSAND_SEPARATOR=False):
+             with translation.override('en'):
+-- 
+2.33.0
+

python-django.spec

@@ -1,7 +1,7 @@
 %global _empty_manifest_terminate_build 0
 Name:		python-django
 Version:	3.2.12
-Release:	8
+Release:	9
 Summary:	A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
 License:	Apache-2.0 and Python-2.0 and BSD-3-Clause
 URL:		https://www.djangoproject.com/
@@ -19,6 +19,8 @@ Patch6:         CVE-2023-41164.patch
 Patch7:         CVE-2023-43665.patch
 # https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2b
 Patch8:         CVE-2023-46695.patch
+# https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820
+Patch9:         CVE-2024-24680.patch
 
 BuildArch:	noarch
 %description
@@ -85,6 +87,9 @@ mv %{buildroot}/doclist.lst .
 %{_docdir}/*
 
 %changelog
+* Wed Feb 07 2024 yaoxin <yao_xin001@hoperun.com> - 3.2.12-9
+- Fix CVE-2024-24680
+
 * Mon Nov 06 2023 yaoxin <yao_xin001@hoperun.com> - 3.2.12-8
 - Fix CVE-2023-46695