Add label and hostname length validation in URLValidator

[Dheerendra Rathor]

Length of labels in hostname (FQDN) should be <= 63 and total length of hostname should be <= 253.

[Raphael Merx]

The label limit of 64 characters can be done like so:

django/core/validators.py

@@ -83 +83 @@
     ipv6_re = r'\[[0-9a-f:\.]+\]'  # (simple regex, validated later)
 
     # Host patterns
-    hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]*[a-z' + ul + r'0-9])?'
+    hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]{0,61}[a-z' + ul + r'0-9])?'
     domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]+(?<!-))*'
     tld_re = r'\.(?:[a-z' + ul + r']{2,}|xn--[a-z0-9]+)\.?'
     host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'

tests/validators/tests.py

@@ -214 +214 @@
     # Trailing junk does not take forever to reject
     (URLValidator(), 'http://www.asdasdasdasdsadfm.com.br ', ValidationError),
     (URLValidator(), 'http://www.asdasdasdasdsadfm.com.br z', ValidationError),
+    # hostname label with length >= 64
+    (URLValidator(), 'http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a.com', ValidationError),
 
     (BaseValidator(True), True, None),
     (BaseValidator(True), False, ValidationError),

The total length limit seems harder to implement.

[Dheerendra Rathor]

63 character limit should be applicable for domain name and TLD regex as well. Total length limit can be implemented by checking the length of host_re group. Also you should your test in invalid_urls.txt.

[Raphael Michel]

Pull request: ​https://github.com/django/django/pull/5566

[Raphael Michel]

apollo13 asked on IRC whether the same length limits apply for IDN domain names and yes, they do: ​https://tools.ietf.org/html/rfc5890#section-2.3.2.1

[Tim Graham <timograham@…>]

In 82976e5c:

Fixed #25637 -- Added URLValidator hostname length validation.

URLValidator now validates the maximum length of a hostname and the
maximum length of all labels inside the hostname.