      def trim_url(x, limit=trim_url_limit):
          return limit is not None and (len(x) > limit and ('%s...' % x[:max(0, limit - 3)])) or x
  
      safe_input = isinstance(text, SafeData)
      words = word_split_re.split(force_text(text))
      for i, word in enumerate(words):
          if '.' in word or '@' in word or ':' in word:
              # Deal with punctuation.
 
</s> remove                 if autoescape and not safe_input:
                    lead, trail = escape(lead), escape(trail)
                    url, trimmed = escape(url), escape(trimmed)
 </s> add                 lead, trail = conditional_escape(lead), conditional_escape(trail)
                url, trimmed = conditional_escape(url), conditional_escape(trimmed) </s> remove                 if safe_input:
                    words[i] = mark_safe(word)
                elif autoescape:
                    words[i] = escape(word)
        elif safe_input:
            words[i] = mark_safe(word)
        elif autoescape:
            words[i] = escape(word)
    return ''.join(words)
 </s> add                 words[i] = conditional_escape(word)
        else:
            words[i] = conditional_escape(word)
    return mark_safe(''.join(words)) </s> remove                 words[i] = mark_safe('%s%s%s' % (lead, middle, trail))
 </s> add                 words[i] = '%s%s%s' % (lead, middle, trail) </s> remove         rendered = template.render(Context({'content': '"http://example.com"'}))
        assert rendered == '"<a href="http://example.com" rel="nofollow">http://example.com</a>"'
 </s> add         rendered = template.render(Context({'content': '<b> "http://example.com" </b>'}))
        assert rendered == '<b> "<a href="http://example.com" rel="nofollow">http://example.com</a>" </b>'
    # Unfortunately, Django built-in cannot be used here, because escaping
    # is to be performed on words, which have been forcibly coerced to text
    def conditional_escape(text):
        return escape(text) if autoescape and not safe_input else text

      def trim_url(x, limit=trim_url_limit):
          return limit is not None and (len(x) > limit and ('%s...' % x[:max(0, limit - 3)])) or x
  
      safe_input = isinstance(text, SafeData)
    # Unfortunately, Django built-in cannot be used here, because escaping
    # is to be performed on words, which have been forcibly coerced to text
    def conditional_escape(text):
        return escape(text) if autoescape and not safe_input else text

      words = word_split_re.split(force_text(text))
      for i, word in enumerate(words):
          if '.' in word or '@' in word or ':' in word:
              # Deal with punctuation.
keep keep keep add keep keep keep keep
 Fix XSS caused by disabled autoescaping in the default DRF Browsable API view templates (#6330)

* Add test that verifies that HTML is correctly escaped in Browsable API views

* Fix `urlize_quoted_links` tag to avoid double escaping in autoescape mode

* Fix XSS in default DRF Browsable API template by re-enabling autoescape 
rest_framework/templatetags/rest_framework.py