django.git/tests/validators/tests.py, branch 4.1.10

[4.1.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and URLValidator.

2023-07-03T06:27:05Z

Thanks Seokchan Yoon for reports.

Fixed #32559 -- Added 'step_size’ to numeric form fields.

2022-05-12T12:16:52Z

Co-authored-by: Jacob Rief

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Refs #33476 -- Refactored problematic code before reformatting by Black.

2022-02-03T10:20:46Z

In these cases Black produces unexpected results, e.g. def make_random_password( self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyz' 'ABCDEFGHJKLMNPQRSTUVWXYZ' '23456789', ): or cursor.execute(""" SELECT ... """, [table name], )

Refs #31670 -- Removed whitelist argument and domain_whitelist attribute in EmailValidator per deprecation timeline.

2021-09-20T19:23:01Z

Refs #22123 -- Added more URLValidator test for invalid IPv6 literals.

2021-08-06T10:58:55Z

Fixed #32959 -- Moved tests URLs to validators.tests.

2021-07-28T09:39:36Z

Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.

2021-06-02T08:58:39Z

validate_ipv4_address() was affected only on Python < 3.9.5, see [1]. URLValidator() uses a regular expressions and it was affected on all Python versions. [1] https://bugs.python.org/issue36384

Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.

2021-05-06T06:45:23Z

In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4

Fixed typo in DecimalValidator tests.

2020-07-16T09:21:39Z

This replaces redundant test for -Infinity with +Infinity.