Fixed #26204 -- Reallowed dashes in top-level domains for URLValidator.

Thanks Shai Berger for the review.

1 files changed, 8 insertions, 1 deletions

diff --git a/django/core/validators.py b/django/core/validators.py
index 5e6265e507..28e1ed5403 100644
--- a/django/core/validators.py
+++ b/django/core/validators.py
@@ -86,7 +86,14 @@ class URLValidator(RegexValidator):
     hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]{0,61}[a-z' + ul + r'0-9])?'
     # Max length for domain name labels is 63 characters per RFC 1034 sec. 3.1
     domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]{1,63}(?<!-))*'
-    tld_re = r'\.(?:[a-z' + ul + r']{2,63}|xn--[a-z0-9]{1,59})\.?'
+    tld_re = (
+        '\.'                                # dot
+        '(?!-)'                             # can't start with a dash
+        '(?:[a-z' + ul + '-]{2,63}'         # domain label
+        '|xn--[a-z0-9]{1,59})'              # or punycode label
+        '(?<!-)'                            # can't end with a dash
+        '\.?'                               # may have a trailing dot
+    )
     host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'
 
     regex = _lazy_re_compile(