From: Pedro Schlickmann Mendes Date: Thu, 20 Jul 2023 12:59:59 +0100 Subject: Fixed URLValidator crash in some edge cases Origin: upstream, https://github.com/django/django/commit/e8b4feddc34ffe5759ec21da8fa027e86e653f1c Bug: https://code.djangoproject.com/ticket/33367 Last-Update: 2021-12-15 --- django/core/validators.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- python-django.orig/django/core/validators.py +++ python-django/django/core/validators.py @@ -118,14 +118,15 @@ class URLValidator(RegexValidator): # Then check full URL try: + splitted_url = urlsplit(value) + except ValueError: + raise ValidationError(self.message, code=self.code, params={'value': value}) + try: super().__call__(value) except ValidationError as e: # Trivial case failed. Try for possible IDN domain if value: - try: - scheme, netloc, path, query, fragment = urlsplit(value) - except ValueError: # for example, "Invalid IPv6 URL" - raise ValidationError(self.message, code=self.code) + scheme, netloc, path, query, fragment = splitted_url try: netloc = netloc.encode('idna').decode('ascii') # IDN -> ACE except UnicodeError: # invalid domain part @@ -136,7 +137,7 @@ class URLValidator(RegexValidator): raise else: # Now verify IPv6 in the netloc part - host_match = re.search(r'^\[(.+)\](?::\d{2,5})?$', urlsplit(value).netloc) + host_match = re.search(r'^\[(.+)\](?::\d{2,5})?$', splitted_url.netloc) if host_match: potential_ip = host_match.groups()[0] try: @@ -148,7 +149,7 @@ class URLValidator(RegexValidator): # section 3.1. It's defined to be 255 bytes or less, but this includes # one byte for the length of the name and one byte for the trailing dot # that's used to indicate absolute names in DNS. - if len(urlsplit(value).netloc) > 253: + if splitted_url.hostname is None or len(splitted_url.hostname) > 253: raise ValidationError(self.message, code=self.code)