new file mode 100644
@@ -0,0 +1,122 @@
+From efea1ef7e2190e3f77ca0651b5458297bc0f6a9f Mon Sep 17 00:00:00 2001
+From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
+Date: Wed, 10 Jul 2024 20:30:12 +0200
+Subject: [PATCH] [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in
+ django.utils.html.urlize() and AdminURLFieldWidget.
+
+Thanks Seokchan Yoon for the report.
+
+Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
+
+CVE: CVE-2024-41991
+
+Upstream-Status: Backport [https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f]
+
+Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
+---
+ django/contrib/admin/widgets.py | 2 +-
+ django/utils/html.py | 10 ++++++++--
+ tests/admin_widgets/tests.py | 7 ++++++-
+ tests/utils_tests/test_html.py | 13 +++++++++++++
+ 4 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/django/contrib/admin/widgets.py b/django/contrib/admin/widgets.py
+index a56baee..47647e8 100644
+--- a/django/contrib/admin/widgets.py
++++ b/django/contrib/admin/widgets.py
+@@ -344,7 +344,7 @@ class AdminURLFieldWidget(forms.URLInput):
+ context = super().get_context(name, value, attrs)
+ context['current_label'] = _('Currently:')
+ context['change_label'] = _('Change:')
+- context['widget']['href'] = smart_urlquote(context['widget']['value']) if value else ''
++ context['widget']['href'] = smart_urlquote(context['widget']['value']) if url_valid else ''
+ context['url_valid'] = url_valid
+ return context
+
+diff --git a/django/utils/html.py b/django/utils/html.py
+index 84e157d..52a3389 100644
+--- a/django/utils/html.py
++++ b/django/utils/html.py
+@@ -12,6 +12,8 @@ from django.utils.http import RFC3986_GENDELIMS, RFC3986_SUBDELIMS
+ from django.utils.safestring import SafeData, SafeText, mark_safe
+ from django.utils.text import normalize_newlines
+
++MAX_URL_LENGTH = 2048
++
+ # Configuration for urlize() function.
+ TRAILING_PUNCTUATION_CHARS = '.,:;!'
+ WRAPPING_PUNCTUATION = [('(', ')'), ('[', ']')]
+@@ -353,6 +355,10 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):
+ except ValueError:
+ # value contains more than one @.
+ return False
++ # Max length for domain name labels is 63 characters per RFC 1034.
++ # Helps to avoid ReDoS vectors in the domain part.
++ if len(p2) > 63:
++ return False
+ # Dot must be in p2 (e.g. example.com)
+ if '.' not in p2 or p2.startswith('.'):
+ return False
+@@ -371,9 +377,9 @@ def urlize(text, trim_url_limit=None, nofollow=False, autoescape=False):
+ # Make URL we want to point to.
+ url = None
+ nofollow_attr = ' rel="nofollow"' if nofollow else ''
+- if simple_url_re.match(middle):
++ if len(middle) <= MAX_URL_LENGTH and simple_url_re.match(middle):
+ url = smart_urlquote(unescape(middle))
+- elif simple_url_2_re.match(middle):
++ elif len(middle) <= MAX_URL_LENGTH and simple_url_2_re.match(middle):
+ url = smart_urlquote('http://%s' % unescape(middle))
+ elif ':' not in middle and is_email_simple(middle):
+ local, domain = middle.rsplit('@', 1)
+diff --git a/tests/admin_widgets/tests.py b/tests/admin_widgets/tests.py
+index 4c14a47..e373f1a 100644
+--- a/tests/admin_widgets/tests.py
++++ b/tests/admin_widgets/tests.py
+@@ -336,7 +336,12 @@ class AdminSplitDateTimeWidgetTest(SimpleTestCase):
+ class AdminURLWidgetTest(SimpleTestCase):
+ def test_get_context_validates_url(self):
+ w = widgets.AdminURLFieldWidget()
+- for invalid in ['', '/not/a/full/url/', 'javascript:alert("Danger XSS!")']:
++ for invalid in [
++ "",
++ "/not/a/full/url/",
++ 'javascript:alert("Danger XSS!")',
++ "http://" + "한.글." * 1_000_000 + "com",
++ ]:
+ with self.subTest(url=invalid):
+ self.assertFalse(w.get_context('name', invalid, {})['url_valid'])
+ self.assertTrue(w.get_context('name', 'http://example.com', {})['url_valid'])
+diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
+index 5abab8d..1956655 100644
+--- a/tests/utils_tests/test_html.py
++++ b/tests/utils_tests/test_html.py
+@@ -254,6 +254,15 @@ class TestUtilsHtml(SimpleTestCase):
+ ),
+ ('foo@example.com', '<a href="mailto:foo@example.com">foo@example.com</a>'),
+ )
++ (
++ "test@" + "한.글." * 15 + "aaa",
++ '<a href="mailto:test@'
++ + "xn--6q8b.xn--bj0b." * 15
++ + 'aaa">'
++ + "test@"
++ + "한.글." * 15
++ + "aaa</a>",
++ ),
+ for value, output in tests:
+ with self.subTest(value=value):
+ self.assertEqual(urlize(value), output)
+@@ -261,6 +270,10 @@ class TestUtilsHtml(SimpleTestCase):
+ def test_urlize_unchanged_inputs(self):
+ tests = (
+ ('a' + '@a' * 50000) + 'a', # simple_email_re catastrophic test
++ # Unicode domain catastrophic tests.
++ "a@" + "한.글." * 1_000_000 + "a",
++ "http://" + "한.글." * 1_000_000 + "com",
++ "www." + "한.글." * 1_000_000 + "com",
+ ('a' + '.' * 1000000) + 'a', # trailing_punctuation catastrophic test
+ 'foo@',
+ '@foo.com',
+--
+2.40.0
@@ -20,6 +20,7 @@ SRC_URI += "file://CVE-2023-31047.patch \
file://CVE-2024-41989-0003.patch \
file://CVE-2024-41989-0004.patch \
file://CVE-2024-41990.patch \
+ file://CVE-2024-41991.patch \
"
SRC_URI[sha256sum] = "0200b657afbf1bc08003845ddda053c7641b9b24951e52acd51f6abda33a7413"