django.git/django/utils/html.py, branch 4.2.29

[4.2.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.

2025-11-05T12:52:56Z

Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

[4.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().

2025-05-07T01:36:15Z

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.

[4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

2024-12-04T13:32:08Z

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart for the reviews.

[4.2.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-09-03T12:42:15Z

Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.

[4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget.

2024-07-31T14:12:23Z

Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

[4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-07-31T14:12:11Z

Thanks to MProgrammer for the report.

[4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-07-09T13:40:37Z

Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

Updated documentation and comments for RFC updates.

2022-11-10T12:52:17Z

- Updated references to RFC 1123 to RFC 5322 - Only partial as RFC 5322 sort of sub-references RFC 1123. - Updated references to RFC 2388 to RFC 7578 - Except RFC 2388 Section 5.3 which has no equivalent. - Updated references to RFC 2396 to RFC 3986 - Updated references to RFC 2616 to RFC 9110 - Updated references to RFC 3066 to RFC 5646 - Updated references to RFC 7230 to RFC 9112 - Updated references to RFC 7231 to RFC 9110 - Updated references to RFC 7232 to RFC 9110 - Updated references to RFC 7234 to RFC 9111 - Tidied up style of text when referring to RFC documents

Fixed #33779 -- Allowed customizing encoder class in django.utils.html.json_script().

2022-06-28T08:54:38Z

Removed unnecessary str type from @keep_lazy decorator for escape()/escapejs().

2022-02-21T08:46:39Z