URLValidator and http/request.py use different validators

[Zach Borboa]

The host validation patterns should probably be the same and written in a way that allows their reuse.

~ ​https://github.com/django/django/blob/master/django/core/validators.py#L99
~ ​https://github.com/django/django/blob/master/django/http/request.py#L25

[Tim Graham]

Unless there is some problem that fixing this will solve, I vote not to try to combine the two. URLValidator changes too often. If we cause some regression there, at least it's some limited compared to if we also break django.http.request.

[Zach Borboa]

host_validation_re could be changed from

host_validation_re = re.compile(r"^([a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9:]+\])(:\d+)?$")

to something like

host_validation_re = re.compile(
        r'(?:' + ipv4_re + '|' + ipv6_re + '|' + host_re + ')'
        r'(?::\d{2,5})?'  # port
)

[Tim Graham]

Florian, what do you think? The regular expression in request.py is a security fix from 27560924ec1e567be4727ef8d7dfc4d3879c048c.

[Florian Apolloner]

I do not see big wins in changing it and am worried that it becomes a nightmare like we have with host_re. Simple & easy is preferable in those code paths imo.

[Tim Graham]

Thanks, sounds like we're in agreement then.