Fix unescaped attributes in Stylesheet.__str__

[Baptiste Mispelon]

_{This was originally reported by Mustafa Barakat as a potential security issue but no vulnerability was identified, hence tracking this publicly}

The django.utils.feedgenerator.Stylesheet class (introduced in #12978) has a __str__ method which is used when outputting a <?xml-stylesheet ... ?>. The method uses f-strings with three different attributes: url, mimetype, and media.

However these attributes are not escaped, which could potentially lead to invalid markup if any of those attributes were to contain a quote for example.

Escaping using Django's escape (or even format_html) should work even though those functions are meant for HTML and not XML.

[Varun Kasyap Pentamaraju]

Willing to contribute

[Varun Kasyap Pentamaraju]

​https://github.com/django/django/pull/20098

[Jacob Walls <jacobtylerwalls@…>]

In e05f2a7:

Fixed #36733 -- Escaped attributes in Stylesheet.str().

Thanks Mustafa Barakat for the report, Baptiste Mispelon for
the triage, and Jake Howard for the review.

[Jacob Walls <jacobtylerwalls@…>]

In ef4715e:

[6.0.x] Fixed #36733 -- Escaped attributes in Stylesheet.str().

Thanks Mustafa Barakat for the report, Baptiste Mispelon for
the triage, and Jake Howard for the review.

Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.

[Jacob Walls <jacobtylerwalls@…>]

In 001c2f54:

[5.2.x] Fixed #36733 -- Escaped attributes in Stylesheet.str().

Thanks Mustafa Barakat for the report, Baptiste Mispelon for
the triage, and Jake Howard for the review.

Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.