id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37359	A-z regex typo in Signer separator validation (django/core/signing.py)	Harsh Parmar		"`_SEP_UNSAFE` in django/core/signing.py currently is:

{{{
_SEP_UNSAFE = _lazy_re_compile(r""^[A-z0-9-_=]*$"")
}}}

`A-z` is the classic ASCII-range regex typo: it spans `A` (0x41) through
`z` (0x7A) inclusive, which — besides `A-Z` and `a-z` — also sweeps in
six punctuation characters that sit between `Z` and `a` in ASCII:
`[ \ ] ^ _ ` ` (`_` was already intended; the other five are the bug).

{{{
>>> import re
>>> p = re.compile(r'^[A-z0-9-_=]*$')
>>> p.match('^')   # True -- should be False, '^' is not in A-Za-z0-9-_=
>>> p.match('{')   # False -- correctly rejected
}}}

This regex rejects ""unsafe"" `sep` values passed to `Signer`/
`TimestampSigner`. The typo only makes the *rejected* set larger than
intended (fails safe, not a security issue) — it just causes a few
legitimate-but-unlikely separator choices like sep=""^"" to be wrongly
rejected with a ValueError.

Suggested fix:

{{{
_SEP_UNSAFE = _lazy_re_compile(r""^[A-Za-z0-9-_=]*$"")
}}}

I have a patch + regression test ready as a PR."	Cleanup/optimization	new	Core (Other)	dev	Normal		signing regex typo	Harsh Parmar	Unreviewed	1	0	0	0	0	0