django.git/django/utils/html.py, branch 5.1.2 django http://cgit.adnoto.dev/django.git/atom?h=5.1.2 2024-09-03T12:24:13Z [5.1.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 2024-09-03T12:24:13Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-08-12T13:17:57Z urn:sha1:022ab0a75c76ab2ea31dfcc5f2cf5501e378d397 Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report. [5.1.x] Refs #34609 -- Fixed deprecation warning stack level in format_html(). 2024-08-27T18:17:47Z Adam Johnson me@adamj.eu 2024-08-27T18:14:50Z urn:sha1:03e0ab5c64d4bc09c6932268b29efcc789a0f7af Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of 2b71b2c8dcd40f2604310bb3914077320035b399 from main. [5.1.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget. 2024-08-06T06:51:22Z Mariusz Felisiak felisiak.mariusz@gmail.com 2024-07-10T18:30:12Z urn:sha1:bd807c0c25ab69361a4c08edcc1cf04d4652aa0a Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> [5.1.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 2024-08-06T06:51:22Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-07-18T11:19:34Z urn:sha1:0c1a8909164d8f2846322efb1143b72ad1616bd8 Thanks to MProgrammer for the report. [5.1.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 2024-07-09T12:42:12Z Adam Johnson me@adamj.eu 2024-06-24T13:30:59Z urn:sha1:44aef996c8d723198e89ca834cb1d746e2e72d77 Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Refs #30686 -- Made django.utils.html.VOID_ELEMENTS a frozenset. 2024-03-14T04:56:22Z Nick Pope nick@nickpope.me.uk 2024-03-14T04:56:22Z urn:sha1:95ae37839c907d7d030f1387a003a5776593d7d7 Refs #30686 -- Moved Parser.SELF_CLOSING_TAGS to django.utils.html.VOID_ELEMENTS 2023-07-14T08:25:00Z David Smith smithdc@gmail.com 2023-07-05T05:51:29Z urn:sha1:1d0dfc0b920916900d2770f3b5640da08af36d97 Fixed #34609 -- Deprecated calling format_html() without arguments. 2023-06-06T12:14:57Z devilsautumn bhuvnesh875@gmail.com 2023-06-06T08:56:53Z urn:sha1:094b0bea2ce76db9d3dc06c384d4ac3b22705810 Refs #34233 -- Used str.removeprefix()/removesuffix(). 2023-01-18T18:11:18Z Mariusz Felisiak felisiak.mariusz@gmail.com 2023-01-18T18:11:18Z urn:sha1:23e886886249ebe8f80a48b0d25fbb5308eeb06f Updated documentation and comments for RFC updates. 2022-11-10T12:52:17Z Nick Pope nick@nickpope.me.uk 2022-11-04T12:33:09Z urn:sha1:9bd174b9a75299dce33e673a559f2b673399b971 - Updated references to RFC 1123 to RFC 5322 - Only partial as RFC 5322 sort of sub-references RFC 1123. - Updated references to RFC 2388 to RFC 7578 - Except RFC 2388 Section 5.3 which has no equivalent. - Updated references to RFC 2396 to RFC 3986 - Updated references to RFC 2616 to RFC 9110 - Updated references to RFC 3066 to RFC 5646 - Updated references to RFC 7230 to RFC 9112 - Updated references to RFC 7231 to RFC 9110 - Updated references to RFC 7232 to RFC 9110 - Updated references to RFC 7234 to RFC 9111 - Tidied up style of text when referring to RFC documents