Fixed #28902 -- Fixed password_validators_help_text_html() double escaping.

1 files changed, 3 insertions, 3 deletions

diff --git a/django/contrib/auth/password_validation.py b/django/contrib/auth/password_validation.py
index 1350dec9c8..4c26e88ac8 100644
--- a/django/contrib/auth/password_validation.py
+++ b/django/contrib/auth/password_validation.py
@@ -9,7 +9,7 @@ from django.core.exceptions import (
     FieldDoesNotExist, ImproperlyConfigured, ValidationError,
 )
 from django.utils.functional import lazy
-from django.utils.html import format_html
+from django.utils.html import format_html, format_html_join
 from django.utils.module_loading import import_string
 from django.utils.translation import gettext as _, ngettext
 
@@ -81,8 +81,8 @@ def _password_validators_help_text_html(password_validators=None):
     in an <ul>.
     """
     help_texts = password_validators_help_texts(password_validators)
-    help_items = [format_html('<li>{}</li>', help_text) for help_text in help_texts]
-    return '<ul>%s</ul>' % ''.join(help_items) if help_items else ''
+    help_items = format_html_join('', '<li>{}</li>', ((help_text,) for help_text in help_texts))
+    return format_html('<ul>{}</ul>', help_items) if help_items else ''
 
 
 password_validators_help_text_html = lazy(_password_validators_help_text_html, str)