django.git/django/core/serializers/xml_serializer.py, branch main

Added support for nested fields to XML deserializer.

2026-04-19T10:38:12Z

Needed by Django MongoDB Backend's EmbeddedModelField.

Fixed #37023 -- Made XML serializer put each ManyToManyField object on its own line.

2026-04-06T17:04:33Z

Refs #37023 -- Removed hardcoded indent levels from XML serializer.

2026-04-06T17:04:33Z

This facilitates nested fields and objects.

Fixed #36750 -- Made ordering of M2M objects deterministic in serializers.

2026-02-26T12:46:35Z

Co-authored-by: Simon Charette Co-authored-by: Jacob Walls

Refs #36769 -- Raised SuspiciousOperation for unexpected nested tags in XML Deserializer.

2026-01-12T21:38:32Z

Thanks Shai Berger and Natalia Bidart for reviews.

Refs #36769 -- Avoided visiting grandchild nodes in XML Deserializer.

2026-01-12T21:38:32Z

The only use case for visiting grandchild nodes turned out to be to support an unintentionally invalid fixture in the test suite. The invalid fixture added in #36969 was modeled on fixture9.xml in dae08cf55b83caef5e8ee39b16417692e8565278, so that is corrected as well in this commit, where the test will still pass.

Fixed #36786 -- Fixed XML serialization of None values in natural keys.

2025-12-22T19:21:01Z

None values in natural keys were incorrectly serialized as the string "None", causing deserialization to fail for fields like UUIDField.

Fixed #36769 -- Avoided visiting deeply nested nodes in XML deserializer.

2025-12-11T17:38:04Z

Only children at one level of depth need to be visited. Co-authored-by: Jacob Walls

Fixed #35729 -- Enabled natural key serialization opt-out for subclasses.

2025-12-03T20:04:52Z

Refactored serialization logic to allow models inheriting a natural_key() method (e.g. AbstractBaseUser) to explicitly opt out of natural key serialization by returning an empty tuple from the method. Thanks Jonas Dittrich for the report. Co-authored-by: Jacob Walls

Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

2025-12-02T12:21:07Z

Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>