utils.html.urlize() isn't thread-safe

[Tim McCurrach]

Since e567670b utils.html.urlize isn't thread safe!

To replicate bug:

1. Write 2 views that both use the urlizetrunc tag a large number of times (between 10⁴ and 10⁵ was enough on my computer).
2. Use different url length limits (for truncation) for each view
3. Load the 2 views simultaneously

The resulting pages will have inconsistent url limits, as the trim_url_limit value from one view leaks over to the other.

The cause

Since urlize was changed to become class-based trim_url_limit, nofollow, autoescape, and trim_url_limit are stored as instance attributes. Urlizer is instantiated just once and then used within urlize which allows for these values to be shared between function calls.

The solution

• The obvious solution would be to pass the values listed above directly to handle_word so that they are not stored on the instance.
• My only question is: Does removing these values from the class instance nullify the ease of customisation the original ticket brought about? If this is the case, the better solution might just be to revert the change.
• An alternative approach would be to create a new instance of Urlizer on each call of urlize, but since this can be called many times in a single request, this would likely have a performance impact.

[Mariusz Felisiak]

Thanks for the report!

The obvious solution would be to pass the values listed above directly to handle_word so that they are not stored on the instance.

Agreed, it's should be enough to pass values to the underlying methods.

My only question is: Does removing these values from the class instance nullify the ease of customisation the original ticket brought about?

I don't think so. As far as I'm aware ​all important parameters will still be customizable.

[Jacob Walls]

​PR

[Claude Paroz]

[HS] Mariusz, do you know why I'm not receiving any mail when you CC me? It's not a problem since I generally follow the timeline, but I still wonder.

[Tim McCurrach]

Replying to Claude Paroz:

[HS] Mariusz, do you know why I'm not receiving any mail when you CC me? It's not a problem since I generally follow the timeline, but I still wonder.

FWIW, I'm not receiving notifications about this ticket either. Strange...

[Mariusz Felisiak <felisiak.mariusz@…>]

In ad81b606:

Fixed #33245 -- Made django.utils.html.urlize() thread-safe.

Regression in e567670b1abe61af4acfaa6a6a7e92a7acfa8b00.

[GitHub <noreply@…>]

In 1f9874d4:

Refs #33245 -- Minor edits to django.utils.html.urlize() changes.

Follow up to ad81b606a2b5276397460a654fc7ad901a54b91e.