Ticket #16664: url_field.patch

django/forms/fields.py

@@ -584 +584 @@
 
     def to_python(self, value):
         if value:
-            url_fields = list(urlparse.urlsplit(value))
+            try:
+                value_splitted = urlparse.urlsplit(value)
+            except ValueError:
+                raise ValidationError(self.error_messages['invalid'])
+
+            url_fields = list(value_splitted)
             if not url_fields[0]:
                 # If no URL scheme given, assume http://
                 url_fields[0] = 'http'
@@ -596 +601 @@
                 # Rebuild the url_fields list, since the domain segment may now
                 # contain the path too.
                 value = urlparse.urlunsplit(url_fields)
-                url_fields = list(urlparse.urlsplit(value))
+                try:
+                    value_splitted = urlparse.urlsplit(value)
+                except ValueError:
+                    raise ValidationError(self.error_messages['invalid'])
+
+                url_fields = list(value_splitted)
             if not url_fields[2]:
                 # the path portion may need to be added before query params
                 url_fields[2] = '/'

tests/regressiontests/forms/tests/fields.py

@@ -587 +587 @@
         self.assertEqual(u'http://valid-----hyphens.com/', f.clean('http://valid-----hyphens.com'))
         self.assertEqual(u'http://some.idn.xyz\xe4\xf6\xfc\xdfabc.domain.com:123/blah', f.clean('http://some.idn.xyzäöüßabc.domain.com:123/blah'))
         self.assertEqual(u'http://www.example.com/s/http://code.djangoproject.com/ticket/13804', f.clean('www.example.com/s/http://code.djangoproject.com/ticket/13804'))
+        self.assertRaisesMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, '[a')
+        self.assertRaisesMessage(ValidationError, "[u'Enter a valid URL.']", f.clean, 'http://[a')
 
     def test_url_regex_ticket11198(self):
         f = URLField()