summaryrefslogtreecommitdiff
path: root/tests/utils_tests
AgeCommit message (Collapse)Author
10 daysFixed #36022 -- Renamed django-admin to django.Ryan Hiebert
This change implements DEP 16: to rename the django-admin command to django. django-admin is kept as an alias. Docs references to the "django-admin" command are updated to "django" or “The django command”. Renamed the `django-admin` Sphinx directive to `cmd`, and the `django-admin-option` directive to `cli-option`. Thanks Johannes Maron, Mike Edmunds, and Jacob Walls for reviews.
2026-10-23Fixed #30949 -- Deprecated django.utils.functional.cached_property.Jacob Rief
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-10-22Fixed #37395 -- Emitted 'none' for CSP directives left empty by an unused nonce.Sanskar Kharya
Before, if a directive's only source was a nonce, and that nonce was not rendered, the directive was omitted, when in reality we should consider the set of scripts matching the nonce to be empty, and instead fail closed. Thanks Rob Hudson for the implementation idea and review.
2026-10-22Fixed #37401 -- Aligned safe_makedirs() with os.makedirs() semantics.Natalia
Python 3.15 added the `parent_mode` argument to `os.makedirs()`, the upstream fix for the issue that led Django to vendor its own `makedirs()` in the fix for CVE-2026-25674. The vendored copy differed from CPython only by an extra `chmod()` call that ignored the process umask. Dropping that call allows using `os.makedirs()` directly on Python 3.15+, and removing the vendored copy once Python 3.14 support ends. As a trade-off, directories created by `FileSystemStorage` when `FILE_UPLOAD_DIRECTORY_PERMISSIONS` (or `directory_permissions_mode`) is set, and by `FileBasedCache`, now have the requested permissions mode combined with the process umask, and the set-group-ID bit and other bits beyond the last 9 are no longer guaranteed to be set. `FILE_UPLOAD_PERMISSIONS` is unaffected. Thanks Shai Berger for the proposal and review, Ken Whitesell and Carlton Gibson for the discussion, and Tim Schilling, Jacob Walls, and Lily for reviews. Refs #36664.
2026-10-22Refs #37433 -- Added django.utils.text.trim_value() helper.Natalia
The debug page and the raster lookup check each trimmed large values to 4096 characters with their own copy of the same code. The shared helper also corrects the suffix, which reported characters as bytes and showed the original length as if it were the amount trimmed. The trimmed value and the suffix are returned separately so callers can escape the value without escaping the suffix. Refs #34746.
2026-10-06Fixed CVE-2026-84429 -- Simplified parse_header_parameters by leveraging ↵Natalia
stdlib's Message. The `parse_header_parameters` function historically used Python's `cgi` module (now deprecated). In 34e2148fc725e7200050f74130d7523e3cd8507a, the logic was inlined to work around this deprecation (#33173). Later, in d4d5427571b4bf3a21c902276c2a00215c2a37cc, the header parsing logic was further cleaned up to align with multipartparser.py (#33697). It was then replaced with Python's email.message.Message API in #35440, and reverted in #36520 over a performance concern on common headers. But recently, a security report showed that `parse_header_parameters()` parsed header values in time quadratic in the number of separators inside a quoted parameter. Because the per-call length limit does not bound the combined size of a repeated header, an unauthenticated request could consume excessive CPU, for example via the `Accept` header, which is parsed by `HttpRequest.accepted_types`. Therefore, this change restores the `email.message.Message` approach, which parses in linear time, while keeping the fast path for headers without parameters and continuing to reject invalid RFC 2231 encodings (#36991). Thanks to Raphael Gaschignard for testing, and to Jake Howard, Adam Johnson, and Shai Berger for reviews. Thanks to Jisung Chae and Peter Thomassen for the security report. Co-authored-by: Khudyakov Artem <khudyak.artem@gmail.com> Co-authored-by: Ben Cail <bcail@crossway.org>
2026-09-27Fixed #37066 -- Wrapped async iteration sites in (maybe_)aclosing.Thomas Grainger
Replaced bare `async for` over a not-locally-defined async iterable with `async with (maybe_)aclosing(aiter(...)) as it: async for item in it:` at every consumption site, so the iterator's aclose() runs deterministically when the consumer exits — instead of being deferred to asyncio's asyncgen finalizer hook. Added django.utils.asyncio.maybe_aclosing as a small wrapper that uses contextlib.aclosing when the iterator has aclose() and contextlib.nullcontext otherwise (for caller-supplied iterators that may only implement __aiter__ and __anext__). Sites: - contrib/auth/backends.py:_aget_permissions (aclosing) - core/paginator.py:AsyncPage.__aiter__ (maybe_aclosing) - core/paginator.py:AsyncPage.aget_object_list (maybe_aclosing) - db/models/query.py:QuerySet.aiterator (aclosing, hoisted across both prefetch and no-prefetch branches) - http/response.py:StreamingHttpResponse.streaming_content awrapper (maybe_aclosing) - http/response.py:StreamingHttpResponse.__iter__ to_list (maybe_aclosing) - http/response.py:StreamingHttpResponse.__aiter__ (aclosing) - shortcuts.py:aget_list_or_404 (aclosing) - test/client.py:aclosing_iterator_wrapper (maybe_aclosing) - utils/text.py:acompress_sequence (maybe_aclosing)
2026-09-15Fixed false positive in func_supports_parameter() for non-keyword args.Mike Edmunds
Clarified that the internal utility `func_supports_parameter()` is meant to check whether `func` supports a particular named argument, and changed it to return False for "args" and "kwargs" on functions that accept variable `*args` and `**kwargs`, as well as for positional-only parameters, which likewise cannot be passed by name.
2026-09-04Fixed #36523 -- Added django.utils.module_loading.qualname() helper.VimalN2005
Thanks Jake Howard for the reivew.
2026-09-03Refs #37293 -- Aliased RemovedInDjango70Warning to RemovedInDjango2028Warning.Carlton Gibson
Updated references to RemovedInDjango70Warning to use the new warning, and adjusted references to "Django 7.0" to "Django 2028". RemovedInDjango70Warning remains importable as an alias of the same class, so existing warning filters and except clauses in third-party code keep working across the rename.
2026-07-27Fixed #37198 -- Fixed content_disposition_header() quoting of filenames ↵Vishy
ending with newlines.
2026-07-10Fixed #36864 -- Supported modules and submodules in import_string().Leland
Before, only submodules worked (and only if already imported). Now, all modules work regardless of prior import state. Updated expected exception in auth tests where import_string() returns a non-callable.
2026-06-19Refs #36560, CVE-2026-35193 -- Recognized qualified cache-control directives.Natalia
The switch from substring matching to exact token membership in 142b881cecaddc334cabec139e701c0e4b9798da caused qualified directive forms permitted by RFC 9111 (e.g. `Cache-Control: private="Set-Cookie"`) to be missed, allowing such responses to be stored in a shared cache. This work added a new `split_directive_names()` helper that yields the lowercased directive name from each token, dropping any qualified value and stripping whitespace around "=", so qualified forms reduce to their directive name. `UpdateCacheMiddleware` now uses it so `private`, `no-cache`, and `no-store` (and the `public` exception for `Authorization`) match regardless of qualified form. Aligned `ConditionalGetMiddleware.needs_etag()` to use the same helper, since it relied on the same brittle exact-token check. Sharing one helper keeps the two directive lookups consistent and means malformed input (e.g. `no-store="x"`) now correctly suppresses the `ETag` instead of being silently ignored. Also stripped whitespace around `=` in `patch_cache_control`'s directive parsing so a qualified directive with stray whitespace is still recognized. Thanks to Jacob Walls for reviews.
2026-06-10Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.zhengkangyang
2026-06-08Refs CVE-2026-48587 -- Added helper to properly split header values.Natalia
Extracted the repeated `split(",")` + per-token `.strip()` pattern into a `split_header_value()` generator in django/utils/http.py. The previous `cc_delim_re` regex only stripped whitespace adjacent to the comma delimiter, leaving leading or trailing whitespace on the first and last tokens. Now, `split_header_value()` strips every token fully, matching RFC 9110's optional-whitespace rules. Thanks to Shai Berger, Jacob Walls, and Sarah Boyce for reviews.
2026-05-04Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() ↵Denny Biasiolli
algorithm. Deprecated the default value of the algorithm argument in django.utils.crypto.salted_hmac() and django.core.signing.base64_hmac(), which will change from 'sha1' to 'sha256' in Django 7.0.
2026-04-22Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.Dinesh
2026-03-10Fixed #36943 -- Preserved any exception from URLconf module in autoreloader.varunkasyap
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-03-09Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware.farhan
This avoids latency and/or blocking. The example of streaming a CSV file was rewritten to employ batching for greater efficiency in all layers (db, HTTP, etc.). The improved performance from batching should outweigh the drag introduced by an additional byte for each flush. Co-authored-by: huoyinghui <huoyinghui@users.noreply.github.com>
2026-03-03Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file ↵Natalia
system object creation. This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz <zspytz@gmail.com> Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.
2026-02-25Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit ↵Natalia
references from HTML truncation docs.
2026-02-03Fixed CVE-2026-1285 -- Mitigated potential DoS in ↵Natalia
django.utils.text.Truncator for HTML input. The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for reviews.
2025-12-24Fixed #36810 -- Avoided infinite recursion in SimpleLazyObject.__repr__().Sean
Detect when `SimpleLazyObject._setupfunc` is a bound method of the same instance to use a safe representation and avoid infinite recursion.
2025-12-24Refs #36810 -- Avoided infinite recursion in LazyNonce.__repr__().Sean Reed
Moved nonce generation in ``django.utils.csp.LazyNonce`` to a function to avoid infinite recursion in ``SimpleLazyObject.__repr__`` for unevaluated instances. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-12-17Fixed #36747 -- Parsed weeks from ISO 8601 format in parse_duration().varunkasyap
2025-12-11Refs #36499 -- Adjusted test_strip_tags following Python behavior change for ↵Jacob Walls
incomplete entities.
2025-11-20Fixed #36737 -- Escaped further control characters in escapejs.farthestmage
2025-11-18Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review.
2025-11-05Fixed #36710 -- Fixed a regression in urlize for multipart domain names.Mehraz Hossain Rumman
Thanks Mehraz Hossain Rumman for the report and Bruno Alla for the triage. Regression in a9fe98d5bd4212d069afe8316101984aadecfbb2.
2025-10-31Fixed #36696 -- Fixed NameError when inspecting functions with deferred ↵Patrick Rauscher
annotations. In Python 3.14, annotations are deferred by default, so we should not assume that the names in them have been imported unconditionally.
2025-10-22Refs #36499 -- Made TestUtilsHtml.test_strip_tags() assume behavior change ↵Mariusz Felisiak
in X.Y.0 version for Python 3.14+. This also removes unsupported versions of Python from the test dict.
2025-10-01Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via ↵Sarah Boyce
archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.
2025-09-25Fixed #36434 -- Preserved unbuffered stdio (-u) in autoreloader child.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-09-16Fixed #35859 -- Added background Tasks framework interface.Jake Howard
This work implements what was defined in DEP 14 (https://github.com/django/deps/blob/main/accepted/0014-background-workers.rst). Thanks to Raphael Gaschignard, Eric Holscher, Ran Benita, Sarah Boyce, Jacob Walls, and Natalia Bidart for the reviews.
2025-09-15Fixed #36520 -- Reverted "Fixed #35440 -- Simplified parse_header_parameters ↵Natalia
by leveraging stdlid's Message." This partially reverts commit 9aabe7eae3eeb3e64c5a0f3687118cd806158550. The simplification of parse_header_parameters using stdlib's Message is reverted due to a performance regression. The check for the header maximum length remains in place, per Security Team guidance. Thanks to David Smith for reporting the regression, and Jacob Walls for the review.
2025-08-28Fixed #35533 -- Prevented urlize creating broken links given a markdown link ↵SaJH
input. Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-27Fixed #36572 -- Revert "Fixed #36546 -- Deprecated ↵Sarah Boyce
django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest()." This reverts commit 0246f478882c26bc1fe293224653074cd46a90d0.
2025-08-25Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in ↵SaJH
favor of hmac.compare_digest(). Signed-off-by: SaJH <wogur981208@gmail.com>
2025-08-14Fixed #36410 -- Added support for Template Partials to the Django Template ↵farhan
Language. Introduced `{% partialdef %}` and `{% partial %}` template tags to define and render reusable named fragments within a template file. Partials can also be accessed using the `template_name#partial_name` syntax via `get_template()`, `render()`, `{% include %}`, and other template-loading tools. Adjusted `get_template()` behavior to support partial resolution, with appropriate error handling for invalid names and edge cases. Introduced `PartialTemplate` to encapsulate partial rendering behavior. Includes tests and internal refactors to support partial context binding, exception reporting, and tag validation. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Nick Pope <nick@nickpope.me.uk>
2025-08-12Fixed #36499 -- Adjusted utils_tests.test_html.TestUtilsHtml.test_strip_tags ↵Natalia
following Python's HTMLParser new behavior. Python fixed a quadratic complexity processing for HTMLParser in: https://github.com/python/cpython/commit/6eb6c5db.
2025-07-23Refs #36500 -- Rewrapped long docstrings and block comments via a script.django-bot
Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-06-27Fixed #15727 -- Added Content Security Policy (CSP) support.Rob Hudson
This initial work adds a pair of settings to configure specific CSP directives for enforcing or reporting policy violations, a new `django.middleware.csp.ContentSecurityPolicyMiddleware` to apply the appropriate headers to responses, and a context processor to support CSP nonces in templates for safely inlining assets. Relevant documentation has been added for the 6.0 release notes, security overview, a new how-to page, and a dedicated reference section. Thanks to the multiple reviewers for their precise and valuable feedback. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-05-06Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().Sarah Boyce
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-02Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report.
2025-03-27Fixed #35440 -- Simplified parse_header_parameters by leveraging stdlid's ↵Khudyakov Artem
Message. The `parse_header_parameters` function historically used Python's `cgi` module (now deprecated). In 34e2148fc725e7200050f74130d7523e3cd8507a, the logic was inlined to work around this deprecation ( #33173). Later, in d4d5427571b4bf3a21c902276c2a00215c2a37cc, the header parsing logic was further cleaned up to align with `multipartparser.py` (#33697). This change takes it a step further by replacing the copied `cgi` logic with Python's `email.message.Message` API for a more robust and maintainable header parsing implementation. Thanks to Raphael Gaschignard for testing, and to Adam Johnson and Shai Berger for reviews. Co-authored-by: Ben Cail <bcail@crossway.org> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-03-19Fixed #36000 -- Deprecated HTTP as the default protocol in urlize and ↵Ahmed Nassar
urlizetrunc.
2025-03-01Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0
2025-02-18Refs #36005 -- Used datetime.UTC alias instead of datetime.timezone.utc.Mariusz Felisiak
datetime.UTC was added in Python 3.11.
2025-01-23Fixed #36013 -- Removed use of IDNA-2003 in django.utils.html.Mike Edmunds
Removed obsolete and potentially problematic IDNA 2003 ("punycode") encoding of international domain names in smart_urlquote() and Urlizer, which are used (only) by AdminURLFieldWidget and the urlize/urlizetrunc template filters. Changed to use percent-encoded UTF-8, which defers IDNA details to the browser (like other URLs rendered by Django).
2025-01-20Fixed #36005 -- Dropped support for Python 3.10 and 3.11.Mariusz Felisiak
generated by cgit v1.3 (git 2.53.0) at 2026-11-15 23:40:00 +0000