django.git/tests/serializers/test_xml.py, branch 4.2.27

[4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

2025-12-02T12:44:40Z

Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.

[4.2.x] Fixed #34620 -- Fixed serialization crash on m2m fields without natural keys when base querysets use select_related().

2023-06-04T18:49:40Z

Regression in 19e0587ee596debf77540d6a08ccb6507e60b6a7. Thanks Martin Svoboda for the report. Backport of f9936deed1ff13b20e18bd9ca2b0750b52706b6c from main

Refs #33476 -- Refactored code to strictly match 88 characters line length.

2022-02-07T19:37:05Z

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed #29249 -- Made JSON and YAML serializers use Unicode by default.

2020-04-28T09:11:39Z

Refs #29249 -- Added tests for serializing Unicode data with XML serializer.

2020-04-28T09:11:39Z

Fixed #28856 -- Fixed a regression in caching of a GenericForeignKey pointing to a MTI model.

2017-11-30T14:28:44Z

Regression in b9f8635f58ad743995cad2081b3dc395e55761e5.

Refs #23919 -- Removed six._types usage

2017-01-18T19:18:46Z

Thanks Tim Graham and Simon Charette for the reviews.

Refs #23919 -- Removed encoding preambles and future imports

2017-01-18T08:55:19Z

Separated XML serialization tests

2015-09-26T17:58:43Z