django.git/docs/topics/serialization.txt, branch stable/6.0.x

[6.0.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

2025-12-02T12:24:55Z

Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.

[6.0.x] Fixed #36581 -- Updated serialization examples from XML to JSON.

2025-09-18T13:45:35Z

Backport of 762d3be8c559b0abf415be8d6117f04fb6347983 from main.

Refs #36485 -- Rewrapped docs to 79 columns line length.

2025-08-25T13:51:10Z

Lines in the docs files were manually adjusted to conform to the 79 columns limit per line (plus newline), improving readability and consistency across the content.

Fixed #29522 -- Refactored the Deserializer functions to classes.

2024-09-17T09:00:49Z

Co-authored-by: Emad Mokhtar

Fixed #34140 -- Reformatted code blocks in docs with blacken-docs.

2023-03-01T12:03:56Z

Refs #34140 -- Corrected rst code-block and various formatting issues in docs.

2023-02-28T11:21:37Z

Refs #34140 -- Applied rst code-block to non-Python examples.

2023-02-10T18:19:13Z

Thanks to J.V. Zammit, Paolo Melchiorre, and Mariusz Felisiak for reviews.

Fixed #34311 -- Updated serialization docs from unique_together to UniqueConstraint.

2023-02-09T04:28:03Z

Refs #30947 -- Changed tuples to lists where appropriate.

2022-08-30T07:57:17Z

Updated example of YAML serialization format in docs.

2021-12-28T11:44:41Z