chango.git/tests/httpwrappers, branch devmain

Fixed #36905 -- Deprecated the safe parameter of JSONResponse.

2026-05-27T15:41:48Z

Peer frameworks have long since dropped their analogous checks for this vulnerability that was fixed in ES5.

Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs.

2026-05-12T19:58:53Z

Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect.

2026-05-04T21:09:20Z

Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.

2025-11-26T20:17:46Z

Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review.

Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.

2025-11-05T12:20:57Z

Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #35784 -- Added support for preserving the HTTP request method in HttpResponseRedirectBase.

2024-11-14T18:53:49Z

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Refs #35727 -- Updated response.content.decode calls to use the HttpResponse.text property.

2024-10-16T09:52:22Z

Signed-off-by: SaJH

Fixed #35727 -- Added HttpResponse.text property.

2024-10-16T09:52:22Z

Signed-off-by: SaJH

Applied Black's 2024 stable style.

2024-01-26T11:45:07Z

https://github.com/psf/black/releases/tag/24.1.0