summaryrefslogtreecommitdiff
path: root/django/core/validators.py
AgeCommit message (Collapse)Author
2021-05-06[3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs ↵Mariusz Felisiak
from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-01-04Fixed #32298 -- Fixed URLValidator hostname length validation.Akshat1Nar
URLValidator now validates the maximum length of a hostname without the userinfo and port.
2020-07-27Fixed #31806 -- Made validators include the value in ValidationErrors.Jon Dufresne
2020-07-27Removed redundant forms.DecimalField.validate() in favor of DecimalValidator.Jon Dufresne
2020-06-18Refs #31670 -- Renamed whitelist argument and attribute of EmailValidator.David Smith
2020-05-11Refs #30116 -- Simplified regex match group access with Match.__getitem__().Jon Dufresne
The method has been available since Python 3.6. The shorter syntax is also marginally faster.
2020-05-08Fixed #31548 -- Fixed URLValidator crash on non-strings.Yash Saini
2020-04-20Capitalized Unicode in docs, strings, and comments.Jon Dufresne
2020-02-28Fixed #31311 -- Removed unneeded escapes in validator regexes.kimbo
Special characters lose their special meaning inside sets of characters. "-" lose its special meaning if it's placed as the first or last character.
2019-10-29Refs #30899 -- Moved _lazy_re_compile() to the django.utils.regex_helper.Hasan Ramezani
2019-10-01Fixed #30651 -- Made __eq__() methods return NotImplemented for not ↵ElizabethU
implemented comparisons. Changed __eq__ to return NotImplemented instead of False if compared to an object of the same type, as is recommended by the Python data model reference. Now these models can be compared to ANY (or other objects with __eq__ overwritten) without returning False automatically.
2019-07-03Refs #30608 -- Added django.utils.encoding.punycode().Mariusz Felisiak
2019-06-28Fixed #30400 -- Improved typography of user facing strings.Jon Dufresne
Thanks Claude Paroz for assistance with translations.
2018-10-22Fixed #29860 -- Allowed BaseValidator to accept a callable limit_value.buzzi
2018-07-23Fixed #29528 -- Made URLValidator reject invalid characters in the username ↵Tim Bell
and password.
2018-04-19Ref #23919 -- Replaced some os.path usage with pathlib.Path.Tom
2018-01-30Fixed #29065 -- Made django.core.validators only load Pillow if needed.Collin Anderson
2018-01-10Fixed #29007 -- Fixed DecimalValidator crash on NaN, SNan, Inf, and Infinity ↵Fabio Bonelli
values.
2017-12-07Fixed #28906 -- Removed unnecessary bool() calls.Tim Graham
2017-09-27Fixed #28562 -- Fixed DecimalValidator handling of positive exponent ↵Josh Schneier
scientific notation.
2017-09-07Reverted "Fixed #27818 -- Replaced try/except/pass with contextlib.suppress()."Tim Graham
This reverts commit 550cb3a365dee4edfdd1563224d5304de2a57fda because try/except performs better.
2017-08-12Fixed #28201 -- Added ProhibitNullCharactersValidator and used it on ↵Alejandro Zamora
CharField form field.
2017-06-28Fixed #27818 -- Replaced try/except/pass with contextlib.suppress().Mads Jensen
2017-06-07Fixed #28165 -- Ignored case in FileExtensionValidator's allowed_extensions.Arne de Laat
2017-05-27Fixed #28249 -- Removed unnecessary dict.keys() calls.Jon Dufresne
iter(dict) is equivalent to iter(dict.keys()).
2017-05-25Made RegexValidator's inverse_match logic clearer.Edward D'Souza
2017-04-27Refs #27795 -- Replaced many force_text() with str()Claude Paroz
Thanks Tim Graham for the review.
2017-03-23Fixed #27952 -- Added translation hint for RegexValidator error message.Paul
2017-03-21Fixed #27945 -- Clarified that RegexValidator searches with the regex.seanfagan
2017-03-04Refs #27795 -- Removed unneeded force_text callsClaude Paroz
Thanks Tim Graham for the review.
2017-02-21Refs #27656 -- Updated django.core docstring verbs according to PEP 257.Anton Samarchyan
2017-02-07Converted usage of ugettext* functions to their gettext* aliasesClaude Paroz
Thanks Tim Graham for the review.
2017-01-30Fixed #27793 -- Used stdlib's ipaddress module to validate IP addressesClaude Paroz
Thanks Tim Graham for the review.
2017-01-26Refs #23919, #27778 -- Removed obsolete mentions of unicode.Vytis Banaitis
2017-01-25Refs #23919 -- Replaced super(ClassName, self) with super().chillaranand
2017-01-25Removed unused variables that are overwritten.Mads Jensen
2017-01-21Refs #23919 -- Removed re.U and re.UNICODE (default on Python 3).Mariusz Felisiak
2017-01-19Refs #23919 -- Stopped inheriting from object to define new style classes.Simon Charette
2017-01-18Refs #23919 -- Removed obsolete __ne__() methods.Aymeric Augustin
__ne__() defaults to the opposite of __eq__() on Python 3 when it doesn't return NotImplemented.
2017-01-18Refs #23919 -- Removed most of remaining six usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed six.<various>_types usageClaude Paroz
Thanks Tim Graham and Simon Charette for the reviews.
2017-01-18Refs #23919 -- Removed encoding preambles and future importsClaude Paroz
2016-11-14Fixed E305 flake8 warnings.Ramin Farajpour Cami
2016-10-28Fixed #26578 -- Prohibited non-ASCII digits in validate_ipv4_address.wim glenn
2016-09-17Refs #27025 -- Fixed "invalid escape sequence" warnings in Python 3.6.Tim Graham
http://bugs.python.org/issue27364
2016-06-30Fixed #21548 -- Added FileExtensionValidator and validate_image_file_extension.Berker Peksag
2016-06-28Fixed #26119 -- Fixed URLValidator crash on URLs with brackets.Christopher Grebs
2016-04-04Fixed W503 flake8 warnings.Tim Graham
2016-02-18Fixed #26204 -- Reallowed dashes in top-level domains for URLValidator.Tim Graham
Thanks Shai Berger for the review.
2016-02-18Fixed #26107 -- Added option to int_list_validator() to allow negative integers.Akshesh
generated by cgit v1.3 (git 2.53.0) at 2026-07-08 12:57:51 +0000