django.git/django/core/servers/basehttp.py, branch main

Fixed #36470 -- Prevented log injection in runserver when handling NOT FOUND.

2025-10-20T19:21:32Z

Migrated `WSGIRequestHandler.log_message()` to use a more robust `log_message()` helper, which was based of `log_response()` via factoring out the common bits. Refs CVE-2025-48432. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed #35051 -- Prevented runserver from removing non-zero Content-Length for HEAD requests.

2023-12-31T07:32:37Z

Fixed #32813 -- Made runserver display port after binding.

2023-02-10T07:22:34Z

Thanks Florian Apolloner for the review.

Fixed #28054 -- Made runserver not return response body for HEAD requests.

2023-01-27T20:49:54Z

Co-authored-by: jannschu

Fixed #33865 -- Optimized LimitedStream wrapper.

2023-01-05T18:26:56Z

The current implementation of LimitedStream is slow because .read() performs an extra copy into a buffer and .readline() performs two extra copies. The stream being wrapped is already typically a BytesIO object so this is unnecessary. This implementation has largely been untouched for 12 years and, inspired by a simpler implementation in werkzeug, it was possible to achieve the following performance improvement: LimitedStream.read() (single line): Mean +- std dev: [bench_limitedstream-main] 286 ns +- 6 ns -> [bench_limitedstream-patch] 227 ns +- 6 ns: 1.26x faster LimitedStream.readline() (single line): Mean +- std dev: [bench_limitedstream-main] 507 ns +- 11 ns -> [bench_limitedstream-patch] 232 ns +- 8 ns: 2.18x faster LimitedStream.read(8192) (single line): Mean +- std dev: [bench_limitedstream-main] 360 ns +- 8 ns -> [bench_limitedstream-patch] 297 ns +- 6 ns: 1.21x faster LimitedStream.readline(8192) (single line): Mean +- std dev: [bench_limitedstream-main] 602 ns +- 10 ns -> [bench_limitedstream-patch] 305 ns +- 10 ns: 1.98x faster LimitedStream.read() (multiple lines): Mean +- std dev: [bench_limitedstream-main] 290 ns +- 5 ns -> [bench_limitedstream-patch] 236 ns +- 6 ns: 1.23x faster LimitedStream.readline() (multiple lines): Mean +- std dev: [bench_limitedstream-main] 517 ns +- 19 ns -> [bench_limitedstream-patch] 239 ns +- 7 ns: 2.16x faster LimitedStream.read(8192) (multiple lines): Mean +- std dev: [bench_limitedstream-main] 363 ns +- 8 ns -> [bench_limitedstream-patch] 311 ns +- 11 ns: 1.17x faster LimitedStream.readline(8192) (multiple lines): Mean +- std dev: [bench_limitedstream-main] 601 ns +- 12 ns -> [bench_limitedstream-patch] 308 ns +- 7 ns: 1.95x faster Geometric mean: 1.59x faster

Refs #25684 -- Removed double newline from request/response output of runserver.

2022-02-14T05:55:34Z

Follow up to 0bc5cd628042bf0a44df60a93085a4f991a84dfb.

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed #32416 -- Made ThreadedWSGIServer close connections after each thread.

2021-04-12T08:23:56Z

ThreadedWSGIServer is used by LiveServerTestCase.

Fixed #32265, Refs #32355 -- Removed unnecessary ServerHandler.handle_error().

2021-01-16T16:37:53Z

ConnectionAbortedError, BrokenPipeError, ConnectionResetError raised from SocketServer.BaseServer.finish_request() are already suppressed by wsgiref.handlers.BaseHandler.run() in Python 3.7+, see https://github.com/python/cpython/commit/47ffc1a9f6fab1c17cdcc325d4af066317369ed7