django.git/tests/utils_tests/test_html.py, branch 4.2.28

[4.2.x] Refs #36499 -- Adjusted test_strip_tags to run on Python 3.8.

2026-01-29T12:24:41Z

[4.2.x] Refs #36499 -- Adjusted test_strip_tags following Python behavior change for incomplete entities.

2026-01-22T18:43:19Z

Backport of 7b80b2186300620931009fd62c2969f108fe7a62 from main.

[4.2.x] Fixed #36499 -- Adjusted utils_tests.test_html.TestUtilsHtml.test_strip_tags following Python's HTMLParser new behavior.

2025-08-13T20:49:51Z

Python fixed a quadratic complexity processing for HTMLParser in: https://github.com/python/cpython/commit/6eb6c5db. Backport of 2980627502c84a9fd09272e1349dc574a2ff1fb1 from main.

[4.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().

2025-05-07T01:36:15Z

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.

[4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

2024-12-04T13:32:08Z

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart for the reviews.

[4.2.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-09-03T12:42:15Z

Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.

[4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget.

2024-07-31T14:12:23Z

Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

[4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-07-31T14:12:11Z

Thanks to MProgrammer for the report.

[4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-07-09T13:40:37Z

Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

Fixed #33779 -- Allowed customizing encoder class in django.utils.html.json_script().

2022-06-28T08:54:38Z