From 065b10e2757af671f3e64f0c8714e6f2e4eca727 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Wed, 15 Dec 2021 11:55:19 -0300 Subject: [PATCH] Fixed #33367 -- Fixed URLValidator crash in some edge cases. From: mendespedro Upstream-Status: Backport [https://github.com/django/django/commit/e8b4feddc34ffe5759ec21da8fa027e86e653f1c] Signed-off-by: Gyorgy Sarvari --- django/core/validators.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/django/core/validators.py b/django/core/validators.py index 94cc3bf..03cd9b8 100644 --- a/django/core/validators.py +++ b/django/core/validators.py @@ -120,15 +120,17 @@ class URLValidator(RegexValidator): raise ValidationError(self.message, code=self.code) # Then check full URL + + try: + splitted_url = urlsplit(value) + except ValueError: + raise ValidationError(self.message, code=self.code, params={'value': value}) try: super().__call__(value) except ValidationError as e: # Trivial case failed. Try for possible IDN domain if value: - try: - scheme, netloc, path, query, fragment = urlsplit(value) - except ValueError: # for example, "Invalid IPv6 URL" - raise ValidationError(self.message, code=self.code) + scheme, netloc, path, query, fragment = splitted_url try: netloc = netloc.encode('idna').decode('ascii') # IDN -> ACE except UnicodeError: # invalid domain part @@ -139,7 +141,7 @@ class URLValidator(RegexValidator): raise else: # Now verify IPv6 in the netloc part - host_match = re.search(r'^\[(.+)\](?::\d{2,5})?$', urlsplit(value).netloc) + host_match = re.search(r'^\[(.+)\](?::\d{2,5})?$', splitted_url.netloc) if host_match: potential_ip = host_match.groups()[0] try: @@ -151,7 +153,7 @@ class URLValidator(RegexValidator): # section 3.1. It's defined to be 255 bytes or less, but this includes # one byte for the length of the name and one byte for the trailing dot # that's used to indicate absolute names in DNS. - if len(urlsplit(value).hostname) > 253: + if splitted_url.hostname is None or len(splitted_url.hostname) > 253: raise ValidationError(self.message, code=self.code)