diff mbox series

[meta-python,kirkstone,3/5] python3-django: fix hostname length validation in URLvalidator

Message ID 20260115082915.2357544-3-skandigraun@gmail.com
State New
Headers show
Series [meta-oe,kirkstone,1/5] exiv2: add ptest support | expand

Commit Message

Gyorgy Sarvari Jan. 15, 2026, 8:29 a.m. UTC 
This patch is for python3-django_2.2.28

The hostname's length has been incorrectly validated, it was checking
an incorrect section of the URL, this made a testcase fail.
This backported patch mitigates this issue.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 ...d-URLValidator-hostname-length-valid.patch | 30 +++++++++++++++++++
 .../python/python3-django_2.2.28.bb           |  1 +
 2 files changed, 31 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-django/0001-Fixed-32298-Fixed-URLValidator-hostname-length-valid.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-django/0001-Fixed-32298-Fixed-URLValidator-hostname-length-valid.patch b/meta-python/recipes-devtools/python/python3-django/0001-Fixed-32298-Fixed-URLValidator-hostname-length-valid.patch
new file mode 100644
index 0000000000..8cab678a36
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django/0001-Fixed-32298-Fixed-URLValidator-hostname-length-valid.patch
@@ -0,0 +1,30 @@ 
+From ee35cb8dd2f903ddde115ca10186e162ffd8dc62 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Sat, 26 Dec 2020 20:52:44 +0530
+Subject: [PATCH] Fixed #32298 -- Fixed URLValidator hostname length
+ validation.
+
+From: Akshat1Nar <akshat.dixit71@gmail.com>
+
+URLValidator now validates the maximum length of a hostname without
+the userinfo and port.
+
+Upstream-Status: Backport [https://github.com/django/django/commit/b41d38ae26b1da9519a6cd765bc2f2ce7d355007]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ django/core/validators.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/django/core/validators.py b/django/core/validators.py
+index 2dbd3bf..94cc3bf 100644
+--- a/django/core/validators.py
++++ b/django/core/validators.py
+@@ -151,7 +151,7 @@ class URLValidator(RegexValidator):
+         # section 3.1. It's defined to be 255 bytes or less, but this includes
+         # one byte for the length of the name and one byte for the trailing dot
+         # that's used to indicate absolute names in DNS.
+-        if len(urlsplit(value).netloc) > 253:
++        if len(urlsplit(value).hostname) > 253:
+             raise ValidationError(self.message, code=self.code)
+ 
+ 
diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.28.bb b/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
index 3dd64a5507..bf7e182aba 100644
--- a/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
+++ b/meta-python/recipes-devtools/python/python3-django_2.2.28.bb
@@ -37,6 +37,7 @@  SRC_URI += "file://CVE-2023-31047.patch \
             file://0001-Fixed-35172-Fixed-intcomma-for-string-floats.patch \
             file://0001-implement-group-method-for-FakeMatch.patch \
             file://0001-fix-ipv6-test.patch \
+            file://0001-Fixed-32298-Fixed-URLValidator-hostname-length-valid.patch \
             "
 
 SRC_URI[sha256sum] = "0200b657afbf1bc08003845ddda053c7641b9b24951e52acd51f6abda33a7413"