From dae08cf55b83caef5e8ee39b16417692e8565278 Mon Sep 17 00:00:00 2001
From: Pravin Kamble <iampbkamble@gmail.com>
Date: Tue, 9 Dec 2025 11:57:52 +0530
Subject: Fixed #36769 -- Avoided visiting deeply nested nodes in XML
 deserializer.

Only children at one level of depth need to be visited.

Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
---
 tests/fixtures/fixtures/invalid_deeply_nested_elements.xml | 10 ++++++++++
 tests/fixtures/tests.py                                    |  9 +++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 tests/fixtures/fixtures/invalid_deeply_nested_elements.xml

(limited to 'tests')

diff --git a/tests/fixtures/fixtures/invalid_deeply_nested_elements.xml b/tests/fixtures/fixtures/invalid_deeply_nested_elements.xml
new file mode 100644
index 0000000000..cd164d3d26
--- /dev/null
+++ b/tests/fixtures/fixtures/invalid_deeply_nested_elements.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<django-objects version="1.0">
+
+    <object pk="1" model="fixtures.person">
+        <field type="CharField" name="name">
+            <natural>Django <em>pony</em></natural>
+        </field>
+    </object>
+
+</django-objects>
diff --git a/tests/fixtures/tests.py b/tests/fixtures/tests.py
index 48e3182b59..7511569d21 100644
--- a/tests/fixtures/tests.py
+++ b/tests/fixtures/tests.py
@@ -23,6 +23,7 @@ from .models import (
     CircularA,
     CircularB,
     NaturalKeyThing,
+    Person,
     PrimaryKeyUUIDModel,
     ProxySpy,
     Spy,
@@ -520,6 +521,14 @@ class FixtureLoadingTests(DumpDataAssertMixin, TestCase):
             natural_foreign_keys=True,
         )
 
+    def test_deeply_nested_elements(self):
+        """Text inside deeply-nested tags is skipped."""
+        management.call_command(
+            "loaddata", "invalid_deeply_nested_elements.xml", verbosity=0
+        )
+        person = Person.objects.get(pk=1)
+        self.assertEqual(person.name, "Django")  # not "Django pony"
+
     def test_dumpdata_with_excludes(self):
         # Load fixture1 which has a site, two articles, and a category
         Site.objects.all().delete()
-- 
cgit v1.3