Urlize email address allows punctuation in domains

[Mike Edmunds]

The urlize template filter incorrectly recognizes domains in email addresses, linkifying punctuation that shouldn't be included in the address:

# Django 5.1.4, Python 3.12.4
from django.template.defaultfilters import urlize
urlize("email me@example.com,then I'll respond")
'email <a href="mailto:me@example.com,then">me@example.com,then</a> I&#x27;ll respond'
urlize("test@example?;+!.com")
'<a href="mailto:test@example?;+!.com">test@example?;+!.com</a>'

The first example should probably stop before the comma. The second example probably shouldn't linkify at all.

See also #36012.

[Mike Edmunds]

Possible fix: Urlizer could check that validate_email() would allow the email address before generating a mailto. That would result in it ignoring both of the examples above. (#36014 would need to be fixed first to avoid rejecting some international domains.)

[Gregory Mariani]

I have done a fix, need to run the CI to validate, first time on this repo for me:
django.utils.html.py

...
    @staticmethod
    def is_email_simple(value):
        """Return True if value looks like an email address."""
        # An @ must be in the middle of the value.
        if "@" not in value or value.startswith("@") or value.endswith("@"):
            return False
        try:
            p1, p2 = value.split("@")
        except ValueError:
            # value contains more than one @.
            return False
        # Max length for domain name labels is 63 characters per RFC 1034.
        # Helps to avoid ReDoS vectors in the domain part.
        if len(p2) > 63:
            return False
        # Dot must be in p2 (e.g. example.com)
        if "." not in p2 or p2.startswith("."):
            return False
        if not validate_email(value):
            return False
        return True

[Gregory Mariani]

Test done and PR validated on PR ​#18959

[Gregory Mariani]

@Sarah Boyce who change the triage if someone has already done a review on the PR ?

[Sarah Boyce <42296566+sarahboyce@…>]

In 61dae11d:

Fixed #36017 -- Used EmailValidator in urlize to detect emails.

[Sarah Boyce <42296566+sarahboyce@…>]

In dab04b89:

[5.2.x] Fixed #36017 -- Used EmailValidator in urlize to detect emails.

Backport of 61dae11df52fae71fc3050974ac459f362c9dfd7 from main.