Corrected HTML-escaping behaviour of url template tag.

Due to the URL encoding applied by the tag for all parameters that might be
partly controllable by an end-user, there are no XSS/security problems
caused by this bug, only invalid HTML.

1 files changed, 3 insertions, 1 deletions

diff --git a/django/template/defaulttags.py b/django/template/defaulttags.py
index b0501505b5..90bdbc25d0 100644
--- a/django/template/defaulttags.py
+++ b/django/template/defaulttags.py
@@ -12,7 +12,7 @@ from django.conf import settings
 from django.utils import six, timezone
 from django.utils.deprecation import RemovedInDjango110Warning
 from django.utils.encoding import force_text, smart_text
-from django.utils.html import format_html
+from django.utils.html import conditional_escape, format_html
 from django.utils.lorem_ipsum import paragraphs, words
 from django.utils.safestring import mark_safe
 
@@ -512,6 +512,8 @@ class URLNode(Node):
             context[self.asvar] = url
             return ''
         else:
+            if context.autoescape:
+                url = conditional_escape(url)
             return url