Ticket #37241: bidi-trojan-source.patch

File bidi-trojan-source.patch, 3.9 KB (added by Mohammed Ahmed Ghanam, 26 hours ago)

Patch attached. Removes U+200F (RLM) characters from affected files.

  • django/conf/locale/ar/formats.py 

    From 05c36611b39e5e9b9c3095ec5ab53a52b5d7457a Mon Sep 17 00:00:00 2001
From: Mohammed Ahmed Ghanam <midoghanam@hotmail.com>
Date: Thu, 30 Jul 2026 11:05:41 +0300
Subject: [PATCH] Fixed CVE-2021-42574 -- Removed bidirectional Unicode control
 characters from RTL locale format files.

---
 django/conf/locale/ar/formats.py  | 2 +-
 django/conf/locale/ckb/formats.py | 2 +-
 django/conf/locale/fa/formats.py  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/django/conf/locale/ar/formats.py b/django/conf/locale/ar/formats.py
index 8008ce6ec4..697b07cdf5 100644
    a b TIME_FORMAT = "g:i A"  
    77# DATETIME_FORMAT =
    88YEAR_MONTH_FORMAT = "F Y"
    99MONTH_DAY_FORMAT = "j F"
    10 SHORT_DATE_FORMAT = "dΓÇÅ/mΓÇÅ/Y"
     10SHORT_DATE_FORMAT = "d/m/Y"
    1111# SHORT_DATETIME_FORMAT =
    1212# FIRST_DAY_OF_WEEK =
    1313

  • django/conf/locale/ckb/formats.py 

    diff --git a/django/conf/locale/ckb/formats.py b/django/conf/locale/ckb/formats.py
index 162c840d33..bad14e900b 100644
    a b DATETIME_FORMAT = "j F Y╪î ┌⌐╪º╪¬┌ÿ┘à█Ä╪▒ G:i"  
    88YEAR_MONTH_FORMAT = "F Y"
    99MONTH_DAY_FORMAT = "j F"
    1010SHORT_DATE_FORMAT = "Y/n/j"
    11 SHORT_DATETIME_FORMAT = "Y/n/j╪îΓÇÅ G:i"
     11SHORT_DATETIME_FORMAT = "Y/n/j╪î G:i"
    1212FIRST_DAY_OF_WEEK = 6
    1313
    1414# The *_INPUT_FORMATS strings use the Python strftime format syntax,

  • django/conf/locale/fa/formats.py 

    diff --git a/django/conf/locale/fa/formats.py b/django/conf/locale/fa/formats.py
index e7019bc7a6..0a5cb1915e 100644
    a b DATETIME_FORMAT = "j F Y╪î ╪│╪º╪╣╪¬ G:i"  
    88YEAR_MONTH_FORMAT = "F Y"
    99MONTH_DAY_FORMAT = "j F"
    1010SHORT_DATE_FORMAT = "Y/n/j"
    11 SHORT_DATETIME_FORMAT = "Y/n/j╪îΓÇÅ G:i"
     11SHORT_DATETIME_FORMAT = "Y/n/j╪î G:i"
    1212FIRST_DAY_OF_WEEK = 6
    1313
    1414# The *_INPUT_FORMATS strings use the Python strftime format syntax,
Back to Top