django.git/django/utils/text.py, branch stable/5.2.x

[5.2.x] Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit references from HTML truncation docs.

2026-02-25T16:12:17Z

Backport of bbc6818bc12f14c1764a7eb68556018195f56b59 from main.

[5.2.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

2026-02-03T13:15:39Z

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for reviews. Backport of a33540b3e20b5d759aa8b2e4b9ca0e8edd285344 from main.

[5.2.x] Fixed #36341 -- Preserved whitespaces in wordwrap template filter.

2025-04-23T19:18:55Z

Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b. This work improves the django.utils.text.wrap() function to ensure that empty lines and lines with whitespace only are kept instead of being dropped. Thanks Matti Pohjanvirta for the report and fix. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 1e9db35836d42a3c72f3d1015c2f302eb6fee046 from main.

[5.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.

2025-03-06T08:42:27Z

Thanks sw0rd1ight for the report. Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.

Refs #30686 -- Removed unused regexes in django.utils.text.

2024-02-15T07:39:14Z

Unused since 6ee37ada3241ed263d8d1c2901b030d964cbd161.

Fixed #30686 -- Used Python HTMLParser in utils.text.Truncator.

2024-02-07T08:46:25Z

Refs #30686 -- Fixed text truncation for negative or zero lengths.

2024-02-07T04:18:35Z

Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text.

2023-10-04T12:22:26Z

Thanks Wenchao Li of Alibaba Group for the report.

Refs #30686 -- Moved add_truncation_text() helper to a module level.

2023-07-14T08:17:14Z

Fixed #34170 -- Implemented Heal The Breach (HTB) in GzipMiddleware.

2022-12-17T07:46:37Z