Ticket #25484: static_escape.2.patch

django/contrib/staticfiles/templatetags/staticfiles.py

@@ -1 +1 @@
 from django import template
 from django.contrib.staticfiles.storage import staticfiles_storage
+from django.utils.html import escape
 from django.templatetags.static import StaticNode
 
 register = template.Library()
@@ -13 +14 @@
 
     def url(self, context):
         path = self.path.resolve(context)
-        return static(path)
+        return escape(static(path))
 
 
 @register.tag('static')

django/templatetags/static.py

@@ -1 +1 @@
 from django import template
 from django.utils.encoding import iri_to_uri
+from django.utils.html import escape
 from django.utils.six.moves.urllib.parse import urljoin
 
 register = template.Library()
@@ -102 +103 @@
     def render(self, context):
         url = self.url(context)
         if self.varname is None:
-            return url
+            return escape(url)
         context[self.varname] = url
         return ''