URLField.to_python() mangles mailto: URLs

[waveywhite]

Having derived from django.forms.URLField and django.models.URLField to set up a form that can handle mailto URLs, I'm finding that the URL gets mangled. Entering "mailto:test@…" results in "mailto://test@…".

This was encountered while creating models for a Wagtail site. Wagtail uses Django's models and form fields within its framework.

My modified URLFields:

from django import forms
from django.db import models

class ContactUrlFormField(forms.URLField):
    default_validators = [
        validators.URLValidator(schemes=['http', 'https', 'mailto', 'tel'])
    ]

class ContactUrlField(models.URLField):
    default_validators = [
        validators.URLValidator(schemes=['http', 'https', 'mailto', 'tel'])
    ]
    
    def formfield(self, **kwargs):
        return super().formfield(
            **{
                "form_class": ContactUrlFormField,
                **kwargs,
            }
        )

NB. It would be great to have a way of defining which URL schemes are allowed as an option in the model field and then have it picked up by the form field automatically.

[Jacob Walls]

Thanks for the report. Looks like the mangling is happening ​here. We shouldn't assume that "if a domain is not provided, that the path segment contains the domain" for mailto links.

Tentatively accepting, since this is a security-sensitive area, and we have to make sure however we adjust this heuristic can't be fooled.

[Vishy Algo]

Replying to Jacob Walls:

The current normalization logic unconditionally assumes a hierarchical structure, forcing mailto:// on opaque schemes like mailto: and tel:.

We could restrict this domain enforcement to an allowlist of standard web schemes (http, https, ftp, ftps) to prevent mangling valid URIs that use data segments. Note that we already default the scheme to http if none is provided.

What's your take on this approach?

[Jacob Walls]

Seems reasonable!

[Jacob Walls]

Hi Vishy. Natalia mentioned she has a local stash that solves this issue. Do you mind if I assign it to her? I don't want you to duplicate any effort.

[Vishy Algo]

Replying to Jacob Walls:

Hi Vishy. Natalia mentioned she has a local stash that solves this issue. Do you mind if I assign it to her? I don't want you to duplicate any effort.

That's fine Jacob. However, I wanna give a heads up on this:

While verifying scheme in django.core.validators.URLValidator , the delimiter used is :// . I think we should just use a semi-colon (":"), which is standard scheme delimiter according to ​RFC 3986 Standards.

Please have a look at this, and provide your opinion.

django/core/validators.py

@@ -166 +166 @@
          if self.unsafe_chars.intersection(value):
              raise ValidationError(self.message, code=self.code, params={"value": value})
          # Check if the scheme is valid.
-        scheme = value.split("://")[0].lower()
+        scheme = value.split(":")[0].lower()
          if scheme not in self.schemes:
              raise ValidationError(self.message, code=self.code, params={"value": value})

Also, the ​IPv6 netloc part verification under the same URLValidator should only be applied to heirarchical/web-style URIs, but not to opaque URIs. I guess, we could use the above obtained scheme to verify that part.

[Jacob Walls]

Good question. The URLValidator is out of scope. I only accepted the ticket for removing the mangling inside to_python(), but I didn't clarify that well enough. (We have other tickets, some of which were wontfixed, for extending URLValidator to work with other schemes, e.g. #36054, #25593, and #25594.)

[Natalia <124304+nessita@…>]

In 951ffb38:

Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of urlsplit() in URLField.to_python() was replaced with
str.partition(":") for URL scheme detection. On Windows, urlsplit()
performs Unicode normalization which is slow for certain characters,
making URLField vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobtylerwalls@…>

[Natalia <124304+nessita@…>]

In b1444d9a:

[6.0.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of urlsplit() in URLField.to_python() was replaced with
str.partition(":") for URL scheme detection. On Windows, urlsplit()
performs Unicode normalization which is slow for certain characters,
making URLField vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobtylerwalls@…>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.

[Natalia <124304+nessita@…>]

In 4d3c184:

[5.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of urlsplit() in URLField.to_python() was replaced with
str.partition(":") for URL scheme detection. On Windows, urlsplit()
performs Unicode normalization which is slow for certain characters,
making URLField vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobtylerwalls@…>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.

[Natalia <124304+nessita@…>]

In b3e8ec8c:

[4.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of urlsplit() in URLField.to_python() was replaced with
str.partition(":") for URL scheme detection. On Windows, urlsplit()
performs Unicode normalization which is slow for certain characters,
making URLField vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobtylerwalls@…>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.

[Natalia Bidart]

The security release I just published solves this issue, though I intentionally did not add tests for this case to avoid polluting a focused security patch. This means that the work needed to close this ticket is proper tests for the reported cases, which should all pass without any code changes AFAIU.

[Natalia Bidart]

​PR

[nessita <124304+nessita@…>]

In 4b6c998:

Fixed #36923 -- Added tests for non-hierarchical URI schemes in URLField.to_python().

Follow up to 951ffb3832cd83ba672c1e3deae2bda128eb9cca.