mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-25 22:56:12 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

Browse Source 
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
This commit is contained in:
Natalia
2025-01-06 15:51:45 -03:00
parent b0d309c9eb
commit ad866a1ca3
7 changed files with 116 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/ref/forms/fields.txt
View File

@@ -719,7 +719,7 @@ For each field, we describe the default widget used if you don't specify
* Empty value: ``''`` (an empty string)
* Normalizes to: A string. IPv6 addresses are normalized as described below.
* Validates that the given value is a valid IP address.
* Error message keys: ``required``, ``invalid``
* Error message keys: ``required``, ``invalid``, ``max_length``
The IPv6 address normalization follows :rfc:`4291#section-2.2` section 2.2,
including using the IPv4 format suggested in paragraph 3 of that section, like
@@ -727,7 +727,7 @@ For each field, we describe the default widget used if you don't specify
``2001::1``, and ``::ffff:0a0a:0a0a`` to ``::ffff:10.10.10.10``. All characters
are converted to lowercase.
Takes two optional arguments:
Takes three optional arguments:
.. attribute:: protocol
@@ -742,6 +742,15 @@ For each field, we describe the default widget used if you don't specify
``192.0.2.1``. Default is disabled. Can only be used
when ``protocol`` is set to ``'both'``.
.. attribute:: max_length
Defaults to 39, and behaves the same way as it does for
:class:`CharField`.
.. versionchanged:: 4.2.18
The default value for ``max_length`` was set to 39 characters.
``ImageField``
--------------