Sarah Boyce 74fa85c688 [5.1.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract(). ...

Thanks stackered for the report.

Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.

Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.

2025-10-01 08:53:50 -04:00

..

archives

Fixed #30160 -- Added support for LZMA and XZ templates to startapp/startproject management commands.

2019-07-31 10:02:13 +02:00

eggs

…

files

Rewrote strip_tags test file to lorem ipsum.

2022-03-08 14:50:06 +01:00

test_module

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

traversal_archives

Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract().

2021-02-01 09:07:36 +01:00

__init__.py

…

deconstructible_classes.py

Refs #21275 -- Added more tests for @deconstructible decorator.

2022-01-04 13:08:36 +01:00

models.py

…

test_archive.py

[5.1.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract().

2025-10-01 08:53:50 -04:00

test_autoreload.py

Used addCleanup() in tests where appropriate.

2023-12-31 10:01:31 +01:00

test_choices.py

Refs #34899 -- Extracted Field.flatchoices to flatten_choices helper function.

2023-10-23 13:44:23 -03:00

test_connection.py

Prevented initialization of unused database connections.

2022-03-17 07:40:57 +01:00

test_crypto.py

Refs #33476 -- Applied Black's 2023 stable style.

2023-02-01 11:04:38 +01:00

test_datastructures.py

Applied Black's 2024 stable style.

2024-01-26 12:45:07 +01:00

test_dateformat.py

Used enterClassContext() where appropriate.

2024-01-04 05:55:29 +01:00

test_dateparse.py

Fixed #35097 -- Tested parse_datetime() with bare date.

2024-01-09 14:08:03 -03:00

test_deconstruct.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_decorators.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_duration.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_encoding.py

Refs #34986 -- Fixed some test assertions for PyPy.

2023-11-28 06:19:38 +01:00

test_feedgenerator.py

Refs #32365 -- Removed internal uses of utils.timezone.utc alias.

2022-03-24 06:29:50 +01:00

test_functional.py

Allowed custom formatting of lazy() objects.

2023-06-12 06:09:20 +02:00

test_hashable.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_html.py

[5.1.x] Fixed #36499 -- Adjusted utils_tests.test_html.TestUtilsHtml.test_strip_tags following Python's HTMLParser new behavior.

2025-08-13 17:49:04 -03:00

test_http.py

[5.1.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in url_has_allowed_host_and_scheme() on Windows.

2025-04-02 10:28:26 +02:00

test_inspect.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_ipv6.py

[5.1.x] Fixed #36098 -- Fixed validate_ipv6_address()/validate_ipv46_address() crash for non-string values.

2025-01-15 13:47:13 -03:00

test_itercompat.py

[5.1.x] Fixed #35666 -- Documented stacklevel usage and testing, and adjusted test suite accordingly.

2024-08-28 11:47:15 -03:00

test_jslex.py

Applied Black's 2024 stable style.

2024-01-26 12:45:07 +01:00

test_lazyobject.py

Fixed utils_tests.test_lazyobject.SimpleLazyObjectPickleTestCase.

2023-08-20 16:09:07 +02:00

test_lorem_ipsum.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_module_loading.py

Fixed #34233 -- Dropped support for Python 3.8 and 3.9.

2023-01-18 09:46:01 +01:00

test_no_submodule.py

…

test_numberformat.py

Refs #34000 -- Optimized handling None values in numberformat.format().

2022-09-12 13:02:50 +02:00

test_os_utils.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_regex_helper.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_safestring.py

Fixed #20296 -- Prevented mark_safe() from evaluating lazy objects.

2022-02-21 10:11:26 +01:00

test_simplelazyobject.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_termcolors.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_text.py

Refs CVE-2024-27351 -- Forwardported release notes and tests.

2024-03-04 08:22:00 +01:00

test_timesince.py

Refs #34483 -- Fixed timesince()/timeuntil() with timezone-aware dates on different days and interval less than 1 day.

2023-04-14 17:41:03 +02:00

test_timezone.py

Fixed #34233 -- Dropped support for Python 3.8 and 3.9.

2023-01-18 09:46:01 +01:00

test_tree.py

Refs #32948 -- Renamed Node._new_instance() to Node.create().

2022-07-27 10:06:24 +02:00

utils.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00