django.git/tests/forms_tests/field_tests/test_urlfield.py, branch main

Fixed #36923 -- Added tests for non-hierarchical URI schemes in URLField.to_python().

2026-03-03T20:40:38Z

Follow up to 951ffb3832cd83ba672c1e3deae2bda128eb9cca.

Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:08:46Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls

Refs #34380 -- Changed the URLField default scheme to https and removed FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.

2025-01-15T21:28:37Z

Fixed #35666 -- Documented stacklevel usage and testing, and adjusted test suite accordingly.

2024-08-28T14:44:05Z

Over the years we've had multiple instances of hit and misses when emitting warnings: either setting the wrong stacklevel or not setting it at all. This work adds assertions for the existing warnings that were declaring the correct stacklevel, but were lacking tests for it.

Refs #34380 -- Added FORMS_URLFIELD_ASSUME_HTTPS transitional setting.

2023-11-28T19:04:21Z

This allows early adoption of the new default "https".

Refs #34986 -- Fixed some test assertions for PyPy.

2023-11-28T05:19:38Z

These failures were due to minor inconsistencies or implementation differences between CPython and PyPy.

Fixed #34380 -- Allowed specifying a default URL scheme in forms.URLField.

2023-04-28T04:58:10Z

This also deprecates "http" as the default scheme.

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed #33367 -- Fixed URLValidator crash in some edge cases.

2021-12-20T06:30:22Z

Used subTest() in forms.URLField() tests.

2021-12-16T05:35:44Z