SRU: Fix URLValidator crash in some edge cases
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
python-django (Ubuntu) |
Fix Released
|
Undecided
|
Graham Inggs | ||
Lunar |
Fix Released
|
Undecided
|
Graham Inggs |
Bug Description
[ Impact ]
* Python 3.11.4 [1] includes the fix:
* gh-103848: Add checks to ensure that [ bracketed ] hosts found by urllib.
* Users wanting to rebuild the package locally will be unable to do so.
* This will prevent migration of the Python 3.11.4 updates to lunar (LP: #2019538). Allowing this autopkgtest to regress will prevent us from detecting more serious regressions in future.
[ Test Plan ]
* Verify that the package does not FTBFS when built with Python 3.11.4.
* Verify that the autopkgtests are successful when tested with Python 3.11.4.
[ Where problems could occur ]
* URLs that that were previously considered valid could now be considered invalid.
[ Other Info ]
* This was fixed upstream [2] in December 2021 in the 4.x branch, but not yet included in a 3.x release.
[1] https:/
[2] https:/
CVE References
Changed in python-django (Ubuntu): | |
assignee: | nobody → Graham Inggs (ginggs) |
Changed in python-django (Ubuntu Lunar): | |
assignee: | nobody → Graham Inggs (ginggs) |
Changed in python-django (Ubuntu): | |
status: | New → In Progress |
description: | updated |
python-django FTBFS with Python 3.11.4 with the following test failures:
======= ======= ======= ======= ======= ======= ======= ======= ======= ======= tests.TestValid ators.test_ validators) [URLValidator] (value='http://[::1:2::3]:8080/') ------- ------- ------- ------- ------- ------- ------- ------- ------- python3. 11/unittest/ case.py" , line 57, in testPartExecutor python3. 11/unittest/ case.py" , line 538, in subTest >>/tests/ validators/ tests.py" , line 354, in test_validators value) >>/django/ core/validators .py", line 132, in __call__ r'^\[(. +)\](?: :\d{2,5} )?$', urlsplit( value). netloc) ^^^^^^^ ^^^^^^^ python3. 11/urllib/ parse.py" , line 500, in urlsplit bracketed_ host(bracketed_ host) ^^^^^^^ ^^^^^^^ python3. 11/urllib/ parse.py" , line 446, in _check_ bracketed_ host ip_address( hostname) # Throws Value Error if not IPv6 or IPv4 ^^^^^^^ ^^^^^^^ python3. 11/ipaddress. py", line 54, in ip_address f'{address! r} does not appear to be an IPv4 or IPv6 address') ^^^^^^^ ^^^^^^^ ^^
ERROR: test_validators (validators.
-------
Traceback (most recent call last):
File "/usr/lib/
yield
File "/usr/lib/
yield
File "/<<PKGBUILDDIR
validator(
File "/<<PKGBUILDDIR
host_match = re.search(
^^^
File "/usr/lib/
_check_
^^^
File "/usr/lib/
ip = ipaddress.
^^^
File "/usr/lib/
raise ValueError(
^
ValueError: '::1:2::3' does not appear to be an IPv4 or IPv6 address
======= ======= ======= ======= ======= ======= ======= ======= ======= ======= placeholder_ with_char_ field (forms_ tests.tests. test_validators .ValidatorCusto mMessageTests. test_value_ placeholder_ with_char_ field) [URLValidator] (value='http://[::1:2::3]/') ------- ------- ------- ------- ------- ------- ------- ------- ------- python3. 11/unittest/ case.py" , line 57, in testPartExecutor python3. 11/unittest/ case.py" , line 538, in subTest >>/tests/ forms_tests/ tests/test_ validators. py", line 108, in test_value_ placeholder_ with_char_ field assertIs( form.is_ valid() , False) ^^^^^^^ ^^^^^^^ >>/django/ forms/forms. py", line 175, in is_valid ^^^^^^^ ^^^^^^^ >>/django/ forms/forms. py", line 170, in errors full_clean( ) >>/django/ forms/forms. py", line 372, in full_clean _clean_ fields( ) ^^^^^^^ ^^^^^^^ >>/django/ forms/forms. py", line 390, in _clean_fields ^^^^^^^ ^^^^^^^ >>/django/ forms/fields. py", line 151, in clean run_validators( value) ^^^^^^^ ^^^^^^^ >>/django/ forms/fields. py", line 136, in run_validators >>/django/ core/validators .py", line 132, in __call__ r'^\[(. +)\](?: :\d{2,5} )?$', urlsplit( value). netloc) ^^^^^^^ ^^^^^^^ python3. 11/urllib/ parse.py" , line 500, in urlsplit bracketed_ host(bracketed_ host) ^^^^^^^ ^^^^^^^ python3. 11/urllib/ parse.py" , line 446, in _check_ bracketed_ host
ERROR: test_value_
-------
Traceback (most recent call last):
File "/usr/lib/
yield
File "/usr/lib/
yield
File "/<<PKGBUILDDIR
self.
^^^
File "/<<PKGBUILDDIR
return self.is_bound and not self.errors
^^^
File "/<<PKGBUILDDIR
self.
File "/<<PKGBUILDDIR
self.
^^^
File "/<<PKGBUILDDIR
value = field.clean(value)
^^^
File "/<<PKGBUILDDIR
self.
^^^
File "/<<PKGBUILDDIR
v(value)
File "/<<PKGBUILDDIR
host_match = re.search(
^^^
File "/usr/lib/
_check_
^^^
File "/usr/lib/
ip = ipaddress.ip_ad...