The following flaw was found in Django:

In a previous release, django.utils.html.strip_tags was changed to work iteratively. The problem is that the size of the input it is processing can increase on each iteration which results in an infinite loop in strip_tags(). This issue only affects versions of Python that haven't received a bugfix in HTMLParser (http://bugs.python.org/issue20288); namely Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported the fix for the Python bug into their packages of earlier versions.

To remedy this issue, strip_tags() will now return the original input if it detects the length of the string it is processing increases. Remember that absolutely NO guarantee is provided about the results of strip_tags() being HTML safe. So NEVER mark safe the result of a strip_tags() call without escaping it first, for example with django.utils.html.escape.

This issue affects Django versions 1.8.x, 1.7.x, and 1.6.x. This issue is fixed in versions 1.8 release candidate 1 (or beta 3), 1.7.7, and 1.6.11.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.