URLValidator regex does not trigger on consecutive periods

[Sully]

The regular expression for ​URLValidator accepts consecutive periods as valid. This bug was introduced in 1.8.3.

Steps to Reproduce

>>> from django.core.validators import URLValidator
>>> validate = URLValidator()
>>> validate('http://example..com')
>>> validate('http://example...............com')

Expected Result

A ​ValidationError exception should be raised.

Current Result

No exception is raised, and the URL is deemed valid.

Reference

​RFC 2181:

The length of any one label is limited to between 1 and 63 octets. A full domain name is limited to 255 octets (including the separators). The zero length full name is defined as representing the root of the DNS tree, and is typically written and displayed as ".".

[Dheerendra Rathor]

Here are the relevant code part from URLValidator (this is from the master branch)

hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]*[a-z' + ul + r'0-9])?'
domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]*(?<!-))*'
tld_re = r'\.(?:[a-z' + ul + r']{2,}|xn--[a-z0-9]+)\.?'
host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'

The culprit is domain_re which allows multiple dots due to '*' on [a-z0-9] part. Changing * to + should solve the problem.

[Tim Graham]

Could you submit the patch as a pull request?

[Dheerendra Rathor]

Recently I've also noted that scheme regex is r'^(?:[a-z0-9\.\-]*)://' but it should have been r'^(?:[a-z0-9\.\-\+]+)://' according to ​rfc1738. I'll update my PR soon.

[Dheerendra Rathor]

Also current regex are not handling label limit of 63 characters and total limit of 253 characters. Should I modify regex to handle them as well?

[Tim Graham]

It's probably better to handle each issue separately. Otherwise, it's difficult to determine which change matches which test.

Making the regex more complex must be done very carefully to avoid issues like 17d3a6d8044752f482453f5906026eaf12c39e8e.

[Dheerendra Rathor]

Cool, then I'll modify regex for domain name and scheme. For length validation I'll open another ticket.

[Tim Graham <timograham@…>]

In 96fe90f:

Fixed #25620 -- Made URLValidator prohibit URLs with consecutive dots in the domain section.

[Tim Graham <timograham@…>]

In 6bb9f51:

[1.9.x] Fixed #25620 -- Made URLValidator prohibit URLs with consecutive dots in the domain section.

Backport of 96fe90f5356971e0e51a0bc41e045dde600d7521 from master

[Tim Graham <timograham@…>]

In 540de2f:

[1.8.x] Fixed #25620 -- Made URLValidator prohibit URLs with consecutive dots in the domain section.

Backport of 96fe90f5356971e0e51a0bc41e045dde600d7521 from master