Fixed #35845 -- Updated DomainNameValidator to require entire string …

…to be a valid domain name.

Bug in 4971a9a.

Thank you to kazet for the report and Claude Paroz for the review.

django/core/validators.py

@@ -101,13 +101,16 @@ def __init__(self, **kwargs):
 
         if self.accept_idna:
             self.regex = _lazy_re_compile(
-                self.hostname_re + self.domain_re + self.tld_re, re.IGNORECASE
+                r"^" + self.hostname_re + self.domain_re + self.tld_re + r"$",
+                re.IGNORECASE,
             )
         else:
             self.regex = _lazy_re_compile(
-                self.ascii_only_hostname_re
+                r"^"
+                + self.ascii_only_hostname_re
                 + self.ascii_only_domain_re
-                + self.ascii_only_tld_re,
+                + self.ascii_only_tld_re
+                + r"$",
                 re.IGNORECASE,
             )
         super().__init__(**kwargs)

docs/releases/5.1.3.txt

@@ -10,4 +10,7 @@ Django 5.1.3 fixes several bugs in 5.1.2 and adds compatibility with Python
 Bugfixes
 ========
 
-* ...
+* Fixed a bug in Django 5.1 where
+  :class:`~django.core.validators.DomainNameValidator` accepted any input value
+  that contained a valid domain name, rather than only input values that were a
+  valid domain name (:ticket:`35845`).

tests/validators/tests.py

@@ -635,8 +635,8 @@
     (validate_domain_name, "python-python.com", None),
     (validate_domain_name, "python.name.uk", None),
     (validate_domain_name, "python.tips", None),
-    (validate_domain_name, "http://例子.测试", None),
-    (validate_domain_name, "http://dashinpunytld.xn---c", None),
+    (validate_domain_name, "例子.测试", None),
+    (validate_domain_name, "dashinpunytld.xn---c", None),
     (validate_domain_name, "python..org", ValidationError),
     (validate_domain_name, "python-.org", ValidationError),
     (validate_domain_name, "too-long-name." * 20 + "com", ValidationError),
@@ -652,6 +652,16 @@
     ),
     (DomainNameValidator(accept_idna=False), "ıçğü.com", ValidationError),
     (DomainNameValidator(accept_idna=False), "not-domain-name", ValidationError),
+    (
+        DomainNameValidator(accept_idna=False),
+        "not-domain-name, but-has-domain-name-suffix.com",
+        ValidationError,
+    ),
+    (
+        DomainNameValidator(accept_idna=False),
+        "not-domain-name.com, but has domain prefix",
+        ValidationError,
+    ),
 ]
 
 # Add valid and invalid URL tests.