summaryrefslogtreecommitdiff
path: root/django/core/validators.py
AgeCommit message (Collapse)Author
2021-05-06[2.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs ↵Mariusz Felisiak
from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2018-10-22Fixed #29860 -- Allowed BaseValidator to accept a callable limit_value.buzzi
2018-07-23Fixed #29528 -- Made URLValidator reject invalid characters in the username ↵Tim Bell
and password.
2018-04-19Ref #23919 -- Replaced some os.path usage with pathlib.Path.Tom
2018-01-30Fixed #29065 -- Made django.core.validators only load Pillow if needed.Collin Anderson
2018-01-10Fixed #29007 -- Fixed DecimalValidator crash on NaN, SNan, Inf, and Infinity ↵Fabio Bonelli
values.
2017-12-07Fixed #28906 -- Removed unnecessary bool() calls.Tim Graham
2017-09-27Fixed #28562 -- Fixed DecimalValidator handling of positive exponent ↵Josh Schneier
scientific notation.
2017-09-07Reverted "Fixed #27818 -- Replaced try/except/pass with contextlib.suppress()."Tim Graham
This reverts commit 550cb3a365dee4edfdd1563224d5304de2a57fda because try/except performs better.
2017-08-12Fixed #28201 -- Added ProhibitNullCharactersValidator and used it on ↵Alejandro Zamora
CharField form field.
2017-06-28Fixed #27818 -- Replaced try/except/pass with contextlib.suppress().Mads Jensen
2017-06-07Fixed #28165 -- Ignored case in FileExtensionValidator's allowed_extensions.Arne de Laat
2017-05-27Fixed #28249 -- Removed unnecessary dict.keys() calls.Jon Dufresne
iter(dict) is equivalent to iter(dict.keys()).
2017-05-25Made RegexValidator's inverse_match logic clearer.Edward D'Souza
2017-04-27Refs #27795 -- Replaced many force_text() with str()Claude Paroz
Thanks Tim Graham for the review.
2017-03-23Fixed #27952 -- Added translation hint for RegexValidator error message.Paul
2017-03-21Fixed #27945 -- Clarified that RegexValidator searches with the regex.seanfagan
2017-03-04Refs #27795 -- Removed unneeded force_text callsClaude Paroz
Thanks Tim Graham for the review.
2017-02-21Refs #27656 -- Updated django.core docstring verbs according to PEP 257.Anton Samarchyan
2017-02-07Converted usage of ugettext* functions to their gettext* aliasesClaude Paroz
Thanks Tim Graham for the review.
2017-01-30Fixed #27793 -- Used stdlib's ipaddress module to validate IP addressesClaude Paroz
Thanks Tim Graham for the review.
2017-01-26Refs #23919, #27778 -- Removed obsolete mentions of unicode.Vytis Banaitis
2017-01-25Refs #23919 -- Replaced super(ClassName, self) with super().chillaranand
2017-01-25Removed unused variables that are overwritten.Mads Jensen
2017-01-21Refs #23919 -- Removed re.U and re.UNICODE (default on Python 3).Mariusz Felisiak
2017-01-19Refs #23919 -- Stopped inheriting from object to define new style classes.Simon Charette
2017-01-18Refs #23919 -- Removed obsolete __ne__() methods.Aymeric Augustin
__ne__() defaults to the opposite of __eq__() on Python 3 when it doesn't return NotImplemented.
2017-01-18Refs #23919 -- Removed most of remaining six usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed six.<various>_types usageClaude Paroz
Thanks Tim Graham and Simon Charette for the reviews.
2017-01-18Refs #23919 -- Removed encoding preambles and future importsClaude Paroz
2016-11-14Fixed E305 flake8 warnings.Ramin Farajpour Cami
2016-10-28Fixed #26578 -- Prohibited non-ASCII digits in validate_ipv4_address.wim glenn
2016-09-17Refs #27025 -- Fixed "invalid escape sequence" warnings in Python 3.6.Tim Graham
http://bugs.python.org/issue27364
2016-06-30Fixed #21548 -- Added FileExtensionValidator and validate_image_file_extension.Berker Peksag
2016-06-28Fixed #26119 -- Fixed URLValidator crash on URLs with brackets.Christopher Grebs
2016-04-04Fixed W503 flake8 warnings.Tim Graham
2016-02-18Fixed #26204 -- Reallowed dashes in top-level domains for URLValidator.Tim Graham
Thanks Shai Berger for the review.
2016-02-18Fixed #26107 -- Added option to int_list_validator() to allow negative integers.Akshesh
2016-01-25Fixed #26125 -- Fixed E731 flake warnings.userimack
2015-12-08Fixed #25637 -- Added URLValidator hostname length validation.Raphael Michel
URLValidator now validates the maximum length of a hostname and the maximum length of all labels inside the hostname.
2015-10-31Fixed #25635 -- Made URLValidator allow '+' in scheme.Dheerendra Rathor
2015-10-29Fixed #25620 -- Made URLValidator prohibit URLs with consecutive dots in the ↵Dheerendra Rathor
domain section.
2015-09-18Fixed #24636 -- Added model field validation for decimal places and max digits.Iulia Chiriac
2015-08-28Fixed #25322 -- Lazily compiled core.validators regular expressions.Jonas Haag
This speeds up import of 'django.core.validators' which can save a few hundred milliseconds when importing the module for the first time. It can be a significant speedup to the django-admin command.
2015-07-17Fixed #16501 -- Added an allow_unicode parameter to SlugField.Edward Henderson
Thanks Flavio Curella and Berker Peksag for the initial patch.
2015-07-08Fixed catastrophic backtracking in URLValidator.Shai Berger
Thanks João Silva for reporting the problem and Tim Graham for finding the problematic RE and for review. This is a security fix; disclosure to follow shortly.
2015-07-08Prevented newlines from being accepted in some validators.Tim Graham
This is a security fix; disclosure to follow shortly. Thanks to Sjoerd Job Postmus for the report and draft patch.
2015-07-06Fixed #25059 -- Allowed Punycode TLDs in URLValidatorAlexey Sveshnikov
2015-04-17Fixed #24349 -- Limited domain name labels to 63 characters in EmailValidatorAnoop Thomas Mathew
2015-03-25Fixed #24531 -- Improved CommaSeparatedIntegerField validation.Bertrand Bordage
`','`, `'1,,1'`, `',1'` etc. are no longer considered as valid comma-separated integer lists.
generated by cgit v1.3 (git 2.53.0) at 2026-07-09 19:46:58 +0000