From c1171ffbd570db90ca206c30f8e2b9f691243820 Mon Sep 17 00:00:00 2001
From: Adam Johnson <me@adamj.eu>
Date: Mon, 22 Jan 2024 13:21:13 +0000
Subject: [PATCH] [3.2.x] Fixed CVE-2024-24680 -- Mitigated potential DoS in
 intcomma template filter.

Thanks Seokchan Yoon for the report.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Co-authored-by: Shai Berger <shai@platonix.com>
---
 .../contrib/humanize/templatetags/humanize.py |  13 +-
 tests/humanize_tests/tests.py                 | 140 ++++++++++++++++--
 2 files changed, 135 insertions(+), 18 deletions(-)

diff --git a/django/contrib/humanize/templatetags/humanize.py b/django/contrib/humanize/templatetags/humanize.py
index 753a0d9..238aaf2 100644
--- a/django/contrib/humanize/templatetags/humanize.py
+++ b/django/contrib/humanize/templatetags/humanize.py
@@ -70,12 +70,13 @@ def intcomma(value, use_l10n=True):
             return intcomma(value, False)
         else:
             return number_format(value, use_l10n=True, force_grouping=True)
-    orig = str(value)
-    new = re.sub(r"^(-?\d+)(\d{3})", r'\g<1>,\g<2>', orig)
-    if orig == new:
-        return new
-    else:
-        return intcomma(new, use_l10n)
+    result = str(value)
+    match = re.match(r"-?\d+", result)
+    if match:
+        prefix = match[0]
+        prefix_with_commas = re.sub(r"\d{3}", r"\g<0>,", prefix[::-1])[::-1]
+        result = prefix_with_commas + result[len(prefix) :]
+    return result
 
 
 # A tuple of standard large number to their converters
diff --git a/tests/humanize_tests/tests.py b/tests/humanize_tests/tests.py
index a0d16bb..3c22787 100644
--- a/tests/humanize_tests/tests.py
+++ b/tests/humanize_tests/tests.py
@@ -66,28 +66,144 @@ class HumanizeTests(SimpleTestCase):
 
     def test_intcomma(self):
         test_list = (
-            100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
-            '10123', '10311', '1000000', '1234567.1234567',
-            Decimal('1234567.1234567'), None,
+            100,
+            -100,
+            1000,
+            -1000,
+            10123,
+            -10123,
+            10311,
+            -10311,
+            1000000,
+            -1000000,
+            1234567.25,
+            -1234567.25,
+            "100",
+            "-100",
+            "1000",
+            "-1000",
+            "10123",
+            "-10123",
+            "10311",
+            "-10311",
+            "1000000",
+            "-1000000",
+            "1234567.1234567",
+            "-1234567.1234567",
+            Decimal("1234567.1234567"),
+            Decimal("-1234567.1234567"),
+            None,
+            "１２３４５６７",
+            "-１２３４５６７",
+            "１２３４５６７.１２",
+            "-１２３４５６７.１２",
+            "the quick brown fox jumped over the lazy dog",
         )
         result_list = (
-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
-            '1,234,567.1234567', None,
+            "100",
+            "-100",
+            "1,000",
+            "-1,000",
+            "10,123",
+            "-10,123",
+            "10,311",
+            "-10,311",
+            "1,000,000",
+            "-1,000,000",
+            "1,234,567.25",
+            "-1,234,567.25",
+            "100",
+            "-100",
+            "1,000",
+            "-1,000",
+            "10,123",
+            "-10,123",
+            "10,311",
+            "-10,311",
+            "1,000,000",
+            "-1,000,000",
+            "1,234,567.1234567",
+            "-1,234,567.1234567",
+            "1,234,567.1234567",
+            "-1,234,567.1234567",
+            None,
+            "1,234,567",
+            "-1,234,567",
+            "１,２３４,５６７.１２",
+            "-１,２３４,５６７.１２",
+            "the quick brown fox jumped over the lazy dog",
         )
         with translation.override('en'):
             self.humanize_tester(test_list, result_list, 'intcomma')
 
     def test_l10n_intcomma(self):
         test_list = (
-            100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
-            '10123', '10311', '1000000', '1234567.1234567',
-            Decimal('1234567.1234567'), None,
+            100,
+            -100,
+            1000,
+            -1000,
+            10123,
+            -10123,
+            10311,
+            -10311,
+            1000000,
+            -1000000,
+            1234567.25,
+            -1234567.25,
+            "100",
+            "-100",
+            "1000",
+            "-1000",
+            "10123",
+            "-10123",
+            "10311",
+            "-10311",
+            "1000000",
+            "-1000000",
+            "1234567.1234567",
+            "-1234567.1234567",
+            Decimal("1234567.1234567"),
+            -Decimal("1234567.1234567"),
+            None,
+            "１２３４５６７",
+            "-１２３４５６７",
+            "１２３４５６７.１２",
+            "-１２３４５６７.１２",
+            "the quick brown fox jumped over the lazy dog",
         )
         result_list = (
-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
-            '100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
-            '1,234,567.1234567', None,
+            "100",
+            "-100",
+            "1,000",
+            "-1,000",
+            "10,123",
+            "-10,123",
+            "10,311",
+            "-10,311",
+            "1,000,000",
+            "-1,000,000",
+            "1,234,567.25",
+            "-1,234,567.25",
+            "100",
+            "-100",
+            "1,000",
+            "-1,000",
+            "10,123",
+            "-10,123",
+            "10,311",
+            "-10,311",
+            "1,000,000",
+            "-1,000,000",
+            "1,234,567.1234567",
+            "-1,234,567.1234567",
+            "1,234,567.1234567",
+            "-1,234,567.1234567",
+            None,
+            "1,234,567",
+            "-1,234,567",
+            "１,２３４,５６７.１２",
+            "-１,２３４,５６７.１２",
+            "the quick brown fox jumped over the lazy dog",
         )
         with self.settings(USE_L10N=True, USE_THOUSAND_SEPARATOR=False):
             with translation.override('en'):
-- 
2.33.0