Subclass URLValidator for URIValidator

Author: jleclanche

CHANGELOG.md

@@ -3,6 +3,7 @@
 * **Compatibility**: Python 3.4 is the new minimum required version.
 * **Compatibility**: Django 2.0 is the new minimum required version.
 * **New feature**: Added TokenMatchesOASRequirements Permissions.
+* validators.URIValidator has been updated to match URLValidator behaviour more closely.
 
 
 ### 1.1.2 [2018-05-12]

oauth2_provider/validators.py

@@ -2,58 +2,39 @@
 from urllib.parse import urlsplit, urlunsplit
 
 from django.core.exceptions import ValidationError
-from django.core.validators import RegexValidator
+from django.core.validators import URLValidator
 from django.utils.encoding import force_text
 from django.utils.translation import ugettext_lazy as _
 
 from .settings import oauth2_settings
 
 
-class URIValidator(RegexValidator):
-    regex = re.compile(
-        r"^(?:[a-z][a-z0-9\.\-\+]*)://"  # scheme...
-        r"(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|"  # domain...
-        r"(?!-)[A-Z\d-]{1,63}(?<!-)|"  # also cover non-dotted domain
-        r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|"  # ...or ipv4
-        r"\[?[A-F0-9]*:[A-F0-9:]+\]?)"  # ...or ipv6
-        r"(?::\d+)?"  # optional port
-        r"(?:/?|[/?]\S+)$", re.IGNORECASE)
-    message = _("Enter a valid URL.")
+class URIValidator(URLValidator):
+    scheme_re = r"^(?:[a-z][a-z0-9\.\-\+]*)://"
 
-    def __call__(self, value):
-        try:
-            super().__call__(value)
-        except ValidationError as e:
-            # Trivial case failed. Try for possible IDN domain
-            if value:
-                value = force_text(value)
-                try:
-                    scheme, netloc, path, query, fragment = urlsplit(value)
-                except ValueError as e:
-                    raise ValidationError("Cannot parse Redirect URI. Error: {}".format(e))
-                try:
-                    netloc = netloc.encode("idna").decode("ascii")  # IDN -> ACE
-                except UnicodeError:  # invalid domain part
-                    raise e
-                url = urlunsplit((scheme, netloc, path, query, fragment))
-                super().__call__(url)
-            else:
-                raise
-        else:
-            url = value
+    dotless_domain_re = r"(?!-)[A-Z\d-]{1,63}(?<!-)"
+    host_re = "|".join((
+        r"(?:"+ URLValidator.host_re,
+        URLValidator.ipv4_re,
+        URLValidator.ipv6_re,
+        dotless_domain_re + ")"
+    ))
+    port_re = r"(?::\d{2,5})?"
+    path_re = r"(?:[/?#][^\s]*)?"
+    regex = re.compile(scheme_re + host_re + port_re + path_re, re.IGNORECASE)
 
 
 class RedirectURIValidator(URIValidator):
     def __init__(self, allowed_schemes):
-        self.allowed_schemes = allowed_schemes
+        super().__init__(schemes=allowed_schemes)
 
     def __call__(self, value):
         super().__call__(value)
         value = force_text(value)
         if len(value.split("#")) > 1:
             raise ValidationError("Redirect URIs must not contain fragments")
         scheme, netloc, path, query, fragment = urlsplit(value)
-        if scheme.lower() not in self.allowed_schemes:
+        if scheme.lower() not in self.schemes:
             raise ValidationError("Redirect URI scheme is not allowed.")
 
 

tests/test_validators.py

@@ -13,19 +13,23 @@ def test_validate_good_uris(self):
             "https://example.org/?key=val",
             "https://example",
             "https://localhost",
+            "https://1.1.1.1",
+            "https://127.0.0.1",
+            "https://255.255.255.255",
         ]
         for uri in good_uris:
             # Check ValidationError not thrown
             validator(uri)
 
     def test_validate_custom_uri_scheme(self):
-        validator = RedirectURIValidator(allowed_schemes=["my-scheme", "https"])
+        validator = RedirectURIValidator(allowed_schemes=["my-scheme", "https", "git+ssh"])
         good_uris = [
             "my-scheme://example.com",
             "my-scheme://example",
             "my-scheme://localhost",
             "https://example.com",
             "HTTPS://example.com",
+            "git+ssh://example.com",
         ]
         for uri in good_uris:
             # Check ValidationError not thrown
@@ -39,15 +43,20 @@ def test_validate_whitespace_separators(self):
 
     def test_validate_bad_uris(self):
         validator = RedirectURIValidator(allowed_schemes=["https"])
-        oauth2_settings.ALLOWED_REDIRECT_URI_SCHEMES = ["https"]
+        oauth2_settings.ALLOWED_REDIRECT_URI_SCHEMES = ["https", "good"]
         bad_uris = [
             "http:/example.com",
             "HTTP://localhost",
             "HTTP://example.com",
             "HTTP://example.com.",
             "http://example.com/#fragment",
-            "my-scheme://example.com"
+            "123://example.com",
+            "http://fe80::1",
+            "git+ssh://example.com",
+            "my-scheme://example.com",
             "uri-without-a-scheme",
+            "https://example.com/#fragment",
+            "good://example.com/#fragment",
             "    ",
             "",
             # Bad IPv6 URL, urlparse behaves differently for these