utils.urlize isn't thread-safe

[Tim McCurrach]

Since e567670b utils.html.urlize isn't thread safe!

To replicate bug:

1. Write 2 views that both use the urlizetrunc tag a large number of times (between 10⁴ and 10⁵ was enough on my computer).
2. Use different url length limits (for truncation) for each view
3. Load the 2 views simultaneously

The resulting pages will have inconsistent url limits, as the trim_url_limit value from one view leaks over to the other.

The cause

Since urlize was changed to become class-based trim_url_limit, nofollow, autoescape, and trim_url_limit are stored as instance attributes. Urlizer is instantiated just once and then used within urlize which allows for these values to be shared between function calls.

The solution

• The obvious solution would be to pass the values listed above directly to handle_word so that they are not stored on the instance.
• My only question is: Does removing these values from the class instance nullify the ease of customisation the original ticket brought about? If this is the case, the better solution might just be to revert the change.
• An alternative approach would be to create a new instance of Urlizer on each call of urlize, but since this can be called many times in a single request, this would likely have a performance impact.