diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/core/validators.py | 7 | ||||
| -rw-r--r-- | django/forms/fields.py | 3 |
2 files changed, 8 insertions, 2 deletions
diff --git a/django/core/validators.py b/django/core/validators.py index 473203a67e..4dae05eb5c 100644 --- a/django/core/validators.py +++ b/django/core/validators.py @@ -104,6 +104,7 @@ class URLValidator(RegexValidator): message = _("Enter a valid URL.") schemes = ["http", "https", "ftp", "ftps"] unsafe_chars = frozenset("\t\r\n") + max_length = 2048 def __init__(self, schemes=None, **kwargs): super().__init__(**kwargs) @@ -111,7 +112,7 @@ class URLValidator(RegexValidator): self.schemes = schemes def __call__(self, value): - if not isinstance(value, str): + if not isinstance(value, str) or len(value) > self.max_length: raise ValidationError(self.message, code=self.code, params={"value": value}) if self.unsafe_chars.intersection(value): raise ValidationError(self.message, code=self.code, params={"value": value}) @@ -203,7 +204,9 @@ class EmailValidator: self.domain_allowlist = allowlist def __call__(self, value): - if not value or "@" not in value: + # The maximum length of an email is 320 characters per RFC 3696 + # section 3. + if not value or "@" not in value or len(value) > 320: raise ValidationError(self.message, code=self.code, params={"value": value}) user_part, domain_part = value.rsplit("@", 1) diff --git a/django/forms/fields.py b/django/forms/fields.py index 8fa7b72cfd..271a178d0b 100644 --- a/django/forms/fields.py +++ b/django/forms/fields.py @@ -609,6 +609,9 @@ class EmailField(CharField): default_validators = [validators.validate_email] def __init__(self, **kwargs): + # The default maximum length of an email is 320 characters per RFC 3696 + # section 3. + kwargs.setdefault("max_length", 320) super().__init__(strip=True, **kwargs) |