diff options
| author | Tim Bell <timothybell@gmail.com> | 2018-07-24 00:30:01 +1000 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2018-07-23 10:30:01 -0400 |
| commit | cdcf4164bec9dc09465424d7042c3f9d4f0f1fdc (patch) | |
| tree | 8c0f1aca7dc13225242d15e3f5615c578931a15f /django | |
| parent | 5a017eef4ccf8c4818d85d3c8e7451998f921356 (diff) | |
Fixed #29528 -- Made URLValidator reject invalid characters in the username and password.
Diffstat (limited to 'django')
| -rw-r--r-- | django/core/validators.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/django/core/validators.py b/django/core/validators.py index 92394a7eae..c1c9cd1c87 100644 --- a/django/core/validators.py +++ b/django/core/validators.py @@ -94,7 +94,7 @@ class URLValidator(RegexValidator): regex = _lazy_re_compile( r'^(?:[a-z0-9\.\-\+]*)://' # scheme is validated separately - r'(?:\S+(?::\S*)?@)?' # user:pass authentication + r'(?:[^\s:@/]+(?::[^\s:@/]*)?@)?' # user:pass authentication r'(?:' + ipv4_re + '|' + ipv6_re + '|' + host_re + ')' r'(?::\d{2,5})?' # port r'(?:[/?#][^\s]*)?' # resource path |