CVS commit: pkgsrc/www/py-django4

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Dec  4 20:21:06 UTC 2024

Modified Files:
        pkgsrc/www/py-django4: Makefile distinfo

Log Message:
py-django4: updated to 4.2.17

4.2.17

Django 4.2.17 fixes one security issue with severity “high” and one security issue with severity “moderate” in 4.2.16.

CVE-2024-53907: Denial-of-service possibility in strip_tags()

strip_tags() would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The strip_tags() method is used to implement the corresponding striptags 
template filter, which was thus also vulnerable.

strip_tags() now has an upper limit of recursive calls to HTMLParser before raising a SuspiciousOperation exception.

Remember that absolutely NO guarantee is provided about the results of strip_tags() being HTML safe. So NEVER mark safe the result of a strip_tags() call without escaping it first, for example with 
django.utils.html.escape().

CVE-2024-53908: Potential SQL injection via HasKey(lhs, rhs) on Oracle

Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle was subject to SQL injection if untrusted data was used as a lhs value.

Applications that use the has_key lookup through the __ syntax are unaffected.


To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 pkgsrc/www/py-django4/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/py-django4/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django4/Makefile
diff -u pkgsrc/www/py-django4/Makefile:1.9 pkgsrc/www/py-django4/Makefile:1.10
--- pkgsrc/www/py-django4/Makefile:1.9  Mon Nov 11 07:29:20 2024
+++ pkgsrc/www/py-django4/Makefile      Wed Dec  4 20:21:06 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.9 2024/11/11 07:29:20 wiz Exp $
+# $NetBSD: Makefile,v 1.10 2024/12/04 20:21:06 adam Exp $
 
-DISTNAME=      Django-4.2.16
+DISTNAME=      Django-4.2.17
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django4/distinfo
diff -u pkgsrc/www/py-django4/distinfo:1.7 pkgsrc/www/py-django4/distinfo:1.8
--- pkgsrc/www/py-django4/distinfo:1.7  Fri Sep  6 07:10:02 2024
+++ pkgsrc/www/py-django4/distinfo      Wed Dec  4 20:21:06 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.7 2024/09/06 07:10:02 adam Exp $
+$NetBSD: distinfo,v 1.8 2024/12/04 20:21:06 adam Exp $
 
-BLAKE2s (Django-4.2.16.tar.gz) = 86f7a81fab05e0ffeb3a3e9c837f70ae4fe89cedce35056669e6701c19072e97
-SHA512 (Django-4.2.16.tar.gz) = a4abe599af711f745f24a559943f67a168cd40f6c7345f2188817e748f9a463e434c463426ca99b80fdaa5580423248c35ff4fcfd35f3364abdf5279094e3f5c
-Size (Django-4.2.16.tar.gz) = 10436023 bytes
+BLAKE2s (Django-4.2.17.tar.gz) = d6915038edd87d51159fc13db5b0dee3ae84a27d612db912e3537163b1f0041a
+SHA512 (Django-4.2.17.tar.gz) = 0811b9416800f3f03fe7eab38f836e130dad67d61117573220b74622e2d47ed71928a200878fe88c444fc5ad33db9e48d0549dfcfeb5482e466278818591ff9c
+Size (Django-4.2.17.tar.gz) = 10437674 bytes