django.git/tests/utils_tests/test_text.py, branch stable/4.2.x

[4.2.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

2026-02-03T13:25:31Z

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report. Backport of a33540b3e20b5d759aa8b2e4b9ca0e8edd285344 from main.

[4.2.x] Fixed CVE-2024-27351 -- Prevented potential ReDoS in Truncator.words().

2024-03-04T07:36:56Z

Thanks Seokchan Yoon for the report. Co-Authored-By: Mariusz Felisiak

[4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text.

2023-10-04T12:39:49Z

Thanks Wenchao Li of Alibaba Group for the report.

Refs #33476 -- Refactored code to strictly match 88 characters line length.

2022-02-07T19:37:05Z

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed unescape_string_literal() crash on empty strings.

2021-12-14T19:19:44Z

Added test for ValueErrors in unescape_string_literal().

2021-12-14T19:18:43Z

Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads.

2021-05-04T06:44:42Z

Refs #27753 -- Removed django.utils.text.unescape_entities() per deprecation timeline.

2021-01-14T16:50:04Z

Refs #27804 -- Used subTest() in tests.utils_tests.test_text.

2020-06-04T09:16:21Z