id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
28638	Make the allowed_hosts parameter mandatory for is_safe_url()	kemar	Piotr Domański	"{{{
>>> from django.utils.http import is_safe_url

>>> is_safe_url(""https://www.djangoproject.com"")
False

>>> is_safe_url(""https://www.djangoproject.com"", allowed_hosts={""www.djangoproject.com""})
True
}}}

If this may have an impact on security, then make it clear that `allowed_hosts` is mandatory by removing its `None` default value [https://github.com/django/django/blob/98706bb35e7de0e445cc336f669919047bf46b75/django/utils/http.py#L265].
"	Cleanup/optimization	closed	Utilities	1.11	Normal	fixed		Florian Apolloner Keryn Knight	Ready for checkin	1	0	0	0	0	0