chango.git - django

Age	Commit message (Collapse)	Author
2025-12-02	[4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵	Shai Berger
	in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2023-06-04	[4.2.x] Fixed #34620 -- Fixed serialization crash on m2m fields without ↵	Mariusz Felisiak
	natural keys when base querysets use select_related(). Regression in 19e0587ee596debf77540d6a08ccb6507e60b6a7. Thanks Martin Svoboda for the report. Backport of f9936deed1ff13b20e18bd9ca2b0750b52706b6c from main
2022-02-07	Refs #33476 -- Refactored code to strictly match 88 characters line length.	Mariusz Felisiak

2022-02-07	Refs #33476 -- Reformatted code with Black.	django-bot

2020-04-28	Fixed #29249 -- Made JSON and YAML serializers use Unicode by default.	Hasan Ramezani

2020-04-28	Refs #29249 -- Added tests for serializing Unicode data with XML serializer.	Hasan Ramezani

2017-11-30	Fixed #28856 -- Fixed a regression in caching of a GenericForeignKey ↵	Simon Charette
	pointing to a MTI model. Regression in b9f8635f58ad743995cad2081b3dc395e55761e5.
2017-01-18	Refs #23919 -- Removed six.<various>_types usage	Claude Paroz
	Thanks Tim Graham and Simon Charette for the reviews.
2017-01-18	Refs #23919 -- Removed encoding preambles and future imports	Claude Paroz

2015-09-26	Separated XML serialization tests	Claude Paroz