django.git/django/utils/html.py, branch stable/5.2.x

[5.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().

2025-05-07T01:24:24Z

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.

[5.2.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in url_has_allowed_host_and_scheme() on Windows.

2025-04-02T08:23:46Z

Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.

[5.2.x] Fixed #36013 -- Removed use of IDNA-2003 in django.utils.html.

2025-01-23T09:40:58Z

Removed obsolete and potentially problematic IDNA 2003 ("punycode") encoding of international domain names in smart_urlquote() and Urlizer, which are used (only) by AdminURLFieldWidget and the urlize/urlizetrunc template filters. Changed to use percent-encoded UTF-8, which defers IDNA details to the browser (like other URLs rendered by Django). Backport of 29ba75e6e57414f0e6f9528d08a520b8b931fb28 from main.

[5.2.x] Fixed #36017 -- Used EmailValidator in urlize to detect emails.

2025-01-20T13:04:35Z

Backport of 61dae11df52fae71fc3050974ac459f362c9dfd7 from main.

Fixed #35998 -- Added caching to django.utils.html.urlize().

2025-01-14T16:59:32Z

Fixed #36012 -- Made mailto punctuation percent-encoded in Urlizer.

2024-12-17T09:18:48Z

Urlizer was not properly encoding email addresses containing punctuation in generated mailto links. Per RFC 6068, fixed by percent encoding (urllib.parse.quote) the local and domain address parts.

Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

2024-12-04T12:43:13Z

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart for the reviews.

Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-09-03T12:22:32Z

Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.

Refs #34609 -- Fixed deprecation warning stack level in format_html().

2024-08-27T18:14:50Z

Co-authored-by: Simon Charette

Fixed #35668 -- Added mapping support to format_html_join.

2024-08-20T06:20:34Z