Unneeded escape sequences in character classes

[Kimball Leavitt]

There are at least three places in the regex in django/core/validators.py that have unnecessary escape sequences inside of character classes:

• ​https://github.com/django/django/blob/master/django/core/validators.py#L68
• ​https://github.com/django/django/blob/master/django/core/validators.py#L85
• ​https://github.com/django/django/blob/master/django/core/validators.py#L166

[Carlton Gibson]

The third example here (L162) is:

r'((?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+)(?:[A-Z0-9-]{2,63}(?<!-))\Z',

I can't see an escape inside a character class there.
Might just be early?

I applied a quick adjustment, which seemed to run OK. (Existing tests passed.)

diff --git a/django/core/validators.py b/django/core/validators.py
index dc0519bb6a..c19fa0becd 100644
--- a/django/core/validators.py
+++ b/django/core/validators.py
@@ -65,7 +65,7 @@ class URLValidator(RegexValidator):
 
     # IP patterns
     ipv4_re = r'(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}'
-    ipv6_re = r'\[[0-9a-f:\.]+\]'  # (simple regex, validated later)
+    ipv6_re = r'\[[0-9a-f:.]+\]'  # (simple regex, validated later)
 
     # Host patterns
     hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]{0,61}[a-z' + ul + r'0-9])?'
@@ -82,7 +82,7 @@ class URLValidator(RegexValidator):
     host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'
 
     regex = _lazy_re_compile(
-        r'^(?:[a-z0-9\.\-\+]*)://'  # scheme is validated separately
+        r'^(?:[a-z0-9.\-+]*)://'  # scheme is validated separately
         r'(?:[^\s:@/]+(?::[^\s:@/]*)?@)?'  # user:pass authentication
         r'(?:' + ipv4_re + '|' + ipv6_re + '|' + host_re + ')'
         r'(?::\d{2,5})?'  # port

Happy to look more closely in a PR.

Thanks for the report.

[Carlton Gibson]

​PR

Yep, this looks fine. Thank you.

[Kimball Leavitt]

Thanks for the review. I submitted a PR for this yesterday - ​https://github.com/django/django/pull/12498/files.

You're right, the third one was wrong. I made the fix first, then submitted the ticket, so I hastily grabbed the wrong line. I changed it so it's correct (​https://github.com/django/django/blob/master/django/core/validators.py#L166).

[Mariusz Felisiak <felisiak.mariusz@…>]

In 7c6b663:

Fixed #31311 -- Removed unneeded escapes in validator regexes.

Special characters lose their special meaning inside sets of characters.

"-" lose its special meaning if it's placed as the first or last
character.