Fixed #26269 -- Prohibited spaces in is_valid_ipv6_address().

2 files changed, 8 insertions, 0 deletions

diff --git a/django/utils/ipv6.py b/django/utils/ipv6.py
index a0cd606043..4f433d198b 100644
--- a/django/utils/ipv6.py
+++ b/django/utils/ipv6.py
@@ -1,6 +1,8 @@
 # This code was mostly based on ipaddr-py
 # Copyright 2007 Google Inc. https://github.com/google/ipaddr-py
 # Licensed under the Apache License, Version 2.0 (the "License").
+import re
+
 from django.core.exceptions import ValidationError
 from django.utils.six.moves import range
 from django.utils.translation import ugettext_lazy as _
@@ -155,6 +157,10 @@ def is_valid_ipv6_address(ip_str):
     """
     from django.core.validators import validate_ipv4_address
 
+    symbols_re = re.compile(r'^[0-9a-fA-F:.]+$')
+    if not symbols_re.match(ip_str):
+        return False
+
     # We need to have at least one ':'.
     if ':' not in ip_str:
         return False
diff --git a/tests/utils_tests/test_ipv6.py b/tests/utils_tests/test_ipv6.py
index 802f0f596e..57bf1d826b 100644
--- a/tests/utils_tests/test_ipv6.py
+++ b/tests/utils_tests/test_ipv6.py
@@ -28,6 +28,8 @@ class TestUtilsIPv6(unittest.TestCase):
         self.assertFalse(is_valid_ipv6_address('1::2:3:4:5:6:7:8'))
         self.assertFalse(is_valid_ipv6_address('1:2'))
         self.assertFalse(is_valid_ipv6_address('1:::2'))
+        self.assertFalse(is_valid_ipv6_address('fe80::223: 6cff:fe8a:2e8a'))
+        self.assertFalse(is_valid_ipv6_address('2a02::223:6cff :fe8a:2e8a'))
 
     def test_validates_incorrect_with_v4mapping(self):
         self.assertFalse(is_valid_ipv6_address('::ffff:999.42.16.14'))