chango.git/django/utils/http.py, branch devmain

Refs CVE-2026-48587 -- Added helper to properly split header values.

2026-06-08T23:06:46Z

Extracted the repeated `split(",")` + per-token `.strip()` pattern into a `split_header_value()` generator in django/utils/http.py. The previous `cc_delim_re` regex only stripped whitespace adjacent to the comma delimiter, leaving leading or trailing whitespace on the first and last tokens. Now, `split_header_value()` strips every token fully, matching RFC 9110's optional-whitespace rules. Thanks to Shai Berger, Jacob Walls, and Sarah Boyce for reviews.

Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.

2026-04-22T18:25:08Z

Refs #35440 -- Optimized parse_header_parameters() for the simplest case.

2026-04-08T21:30:05Z

Added a fast-path to parse_header_parameters Benchmark results (50,000 iterations): - Simple headers: ~73% improvement Thanks Nick Pope (@ngnpope) for the review.

Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.

2025-11-26T20:17:46Z

Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review.

Fixed #36705 -- Avoided string concatenation in utils.

2025-11-07T19:06:42Z

Repeated string concatenation performs poorly on PyPy. Thanks Seokchan Yoon for the report.

Fixed #36520 -- Reverted "Fixed #35440 -- Simplified parse_header_parameters by leveraging stdlid's Message."

2025-09-16T01:14:50Z

This partially reverts commit 9aabe7eae3eeb3e64c5a0f3687118cd806158550. The simplification of parse_header_parameters using stdlib's Message is reverted due to a performance regression. The check for the header maximum length remains in place, per Security Team guidance. Thanks to David Smith for reporting the regression, and Jacob Walls for the review.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed CVE-2025-27556 -- Mitigated potential DoS in url_has_allowed_host_and_scheme() on Windows.

2025-04-02T08:21:33Z

Thank you sw0rd1ight for the report.

Fixed #35440 -- Simplified parse_header_parameters by leveraging stdlid's Message.

2025-03-27T11:57:03Z

The `parse_header_parameters` function historically used Python's `cgi` module (now deprecated). In 34e2148fc725e7200050f74130d7523e3cd8507a, the logic was inlined to work around this deprecation ( #33173). Later, in d4d5427571b4bf3a21c902276c2a00215c2a37cc, the header parsing logic was further cleaned up to align with `multipartparser.py` (#33697). This change takes it a step further by replacing the copied `cgi` logic with Python's `email.message.Message` API for a more robust and maintainable header parsing implementation. Thanks to Raphael Gaschignard for testing, and to Adam Johnson and Shai Berger for reviews. Co-authored-by: Ben Cail Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Refs #36005 -- Used datetime.UTC alias instead of datetime.timezone.utc.

2025-02-18T07:35:36Z

datetime.UTC was added in Python 3.11.