id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37279	URLValidator accepts null characters in URLs	Nguyễn Anh Bình		"`URLValidator` rejects tab and newline characters (via `unsafe_chars = frozenset(""\t\r\n"")`, added in #32713) but not the null character (`\x00`).

Example (Django 6.2.dev):

{{{#!pycon
>>> from django.core.validators import URLValidator
>>> URLValidator()(""http://www.djangoproject.com/\x00"")  # no newline/tab, contains \x00
>>> URLValidator()(""http://example.com/page\x00@example.com/"")
}}}

Neither call raises `ValidationError`.

This is inconsistent with the rest of Django's input handling:

* `forms.CharField` (and therefore `forms.URLField`) rejects `\x00` via `ProhibitNullCharactersValidator` (#28201), so the same value submitted through a form is rejected.
* Model-level `URLField` only applies `URLValidator()`, so values that reach `Model.full_clean()` through non-form paths (data imports, management commands, direct ORM writes from other systems) validate successfully while the identical value would fail any Django form.
* `ProhibitNullCharactersValidator` exists precisely because NUL cannot appear in a valid URL and causes failures in downstream components (e.g. most databases reject or truncate it; PostgreSQL raises ""A string literal cannot contain NUL (0x00) characters"").

Null characters are invalid in URLs per RFC 3986 (excluded from every grammar production, ASCII control characters must be percent-encoded).

Proposed fix, mirroring the #32713 approach:

{{{#!diff
--- a/django/core/validators.py
+++ b/django/core/validators.py
@@ class URLValidator(RegexValidator):
-    unsafe_chars = frozenset(""\t\r\n"")
+    unsafe_chars = frozenset(""\t\r\n\x00"")
}}}

Happy to submit a PR with tests.

(Initially reported to security@djangoproject.com; the team classified it as non-security since form-based flows already reject NUL, and suggested the public tracker for the consistency hardening.)"	Bug	new	Core (Other)	dev	Normal				Unreviewed	1	0	0	0	0	0