Fixed #25484 -- Made {% static %} render escaped URLs.

1 files changed, 5 insertions, 2 deletions

diff --git a/django/templatetags/static.py b/django/templatetags/static.py
index 1e57e5a8d7..41e6c581ba 100644
--- a/django/templatetags/static.py
+++ b/django/templatetags/static.py
@@ -1,7 +1,8 @@
 from django import template
 from django.apps import apps
 from django.utils.encoding import iri_to_uri
-from django.utils.six.moves.urllib.parse import urljoin
+from django.utils.html import conditional_escape
+from django.utils.six.moves.urllib.parse import unquote, urljoin
 
 register = template.Library()
 
@@ -101,7 +102,9 @@ class StaticNode(template.Node):
         return self.handle_simple(path)
 
     def render(self, context):
-        url = self.url(context)
+        url = unquote(self.url(context))
+        if context.autoescape:
+            url = conditional_escape(url)
         if self.varname is None:
             return url
         context[self.varname] = url