008ReviewmidPython / Django真实来源改编 Django
Django:用户名校验拒绝末尾换行
审查 Django auth 的一个小补丁:作者发现 UsernameValidator 的正则允许末尾带换行符的用户名通过校验,调整了正则锚点让这类输入被拒绝。
@@ -7,7 +7,7 @@ from django.utils.translation import gettext_lazy as _ @deconstructible class ASCIIUsernameValidator(validators.RegexValidator):- regex = r'^[\w.@+-]+$'+ regex = r'^[\w.@+-]+\Z' message = _( 'Enter a valid username. This value may contain only English letters, ' 'numbers, and @/./+/-/_ characters.'@@ -17,7 +17,7 @@ class ASCIIUsernameValidator(validators.RegexValidator): @deconstructible class UnicodeUsernameValidator(validators.RegexValidator):- regex = r'^[\w.@+-]+$'+ regex = r'^[\w.@+-]+\Z' message = _( 'Enter a valid username. This value may contain only letters, ' 'numbers, and @/./+/-/_ characters.'@@ -237,7 +237,7 @@ class UsernameValidatorsTests(SimpleTestCase): invalid_usernames = [ "o'connell", "عبد ال", "zerowidth\u200Bspace", "nonbreaking\u00A0space",- "en\u2013dash",+ "en\u2013dash", 'trailingnewline\u000A', ] v = validators.UnicodeUsernameValidator() for valid in valid_usernames:@@ -250,7 +250,7 @@ class UsernameValidatorsTests(SimpleTestCase): def test_ascii_validator(self): valid_usernames = ['glenn', 'GLEnN', 'jean-marc']- invalid_usernames = ["o'connell", 'Éric', 'jean marc', "أحمد"]+ invalid_usernames = ["o'connell", 'Éric', 'jean marc', "أحمد", 'trailingnewline\n'] v = validators.ASCIIUsernameValidator() for valid in valid_usernames: with self.subTest(valid=valid):