id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
24531	CommaSeparatedIntegerField validation not specific enough	Bertrand Bordage	nobody	"The `CommaSeparatedIntegerField` validator, `validate_comma_separated_integer_list`, currently allows strange values such as `','`, `',,'`, `',1,2,'`, `'1,,2'`.

Two issues here:
- In my opinion,`','` and `',,'` can’t mean anything else than “no info”. One may argue that it can mean “no info, no info” and “no info, no info, no info”, but that’s weird and what it could mean about your data isn’t clear. I think this only adds confusion compared to `''`.
- Most people won’t expect this and will only apply `string.split(',')` on it, which may lead to unexpected empty strings in the resulting list.

[https://github.com/django/django/pull/4133 Pull request 4133] proposes a fix by using a more specific regular expression to validate data.
It also introduces `int_list_validator`, a function to make it easier to create a similar validator with another separator than a comma. This is useful in some languages like French where comma is used as a decimal separator. Some french people may read comma-separated values as english would read `10.5.900`, which is misleading. Using other separators like `;` is therefore easy using this `int_list_validator` function."	Bug	closed	Core (Other)	dev	Normal	fixed			Accepted	1	0	0	1	0	0