Prevented reverse() from generating URLs pointing to other hosts.

This is a security fix. Disclosure following shortly.

2 files changed, 6 insertions, 0 deletions

diff --git a/tests/urlpatterns_reverse/tests.py b/tests/urlpatterns_reverse/tests.py
index 5603ea5f15..dbb1836b7a 100644
--- a/tests/urlpatterns_reverse/tests.py
+++ b/tests/urlpatterns_reverse/tests.py
@@ -152,6 +152,9 @@ test_data = (
     ('defaults', '/defaults_view2/3/', [], {'arg1': 3, 'arg2': 2}),
     ('defaults', NoReverseMatch, [], {'arg1': 3, 'arg2': 3}),
     ('defaults', NoReverseMatch, [], {'arg2': 1}),
+
+    # Security tests
+    ('security', '/%2Fexample.com/security/', ['/example.com'], {}),
 )
 
 
diff --git a/tests/urlpatterns_reverse/urls.py b/tests/urlpatterns_reverse/urls.py
index 943f92e956..4ba596d81c 100644
--- a/tests/urlpatterns_reverse/urls.py
+++ b/tests/urlpatterns_reverse/urls.py
@@ -75,4 +75,7 @@ with warnings.catch_warnings(record=True):
         (r'defaults_view2/(?P<arg1>[0-9]+)/', defaults_view, {'arg2': 2}, 'defaults'),
 
         url('^includes/', include(other_patterns)),
+
+        # Security tests
+        url('(.+)/security/$', empty_view, name='security'),
     )