id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
26036	URL dispatcher including forward slashes in parameter capture	Matthew Riedel	nobody	"Given the following URL object:

{{{
url(r'^password/(?P<username>\S+)/$', views.reset_password, name='password'),
}}}

and the following URL:

{{{
password/myusername/favicon.ico/
}}}

Django seems to be capturing {{{username}}} as {{{myusername/favicon.ico}}} instead of {{{myusername}}}.

When tested in Python's CLI, the parameter capture works properly:

{{{
>>> url = re.compile(r'^password/(?P<username>\S+)/', re.U)
>>> match = url.match('password/myusername/favicon.ico')
>>> match.group('username')
'myusername'
>>> url = re.compile(r'^password/(?P<username>\S+)/', re.L)
>>> match = url.match('password/myusername/favicon.ico')
>>> match.group('username')
'myusername'
}}}

I would expect if the regexp was the issue, I would see {{{mysuername/favicon.ico}}} in the Python output, also.

I'm using Python 2.7.5 on RHEL 7 with a Virtual Environment for Django 1.8.8. This also happens in 1.8.7. No changes were made to this application's {{{url.py}}} file since July, and this issue only popped up since updating to Django 1.8.7 from an earlier version of Django 1.8 (not sure which minor version).

For now, I'm using a {{{\w+}}} regular expression instead of a {{{\S+}}} - but that's only a temporary fix. Sometimes I do need to match on special characters other than underscore (e.g., dash, plus sign, etc.)"	Bug	closed	Core (URLs)	1.8	Normal	invalid	url forward slash parameter		Unreviewed	0	0	0	0	0	0