008ReviewmidPython / Django真实来源改编 Django

Django:用户名校验拒绝末尾换行

审查 Django auth 的一个小补丁:作者发现 UsernameValidator 的正则允许末尾带换行符的用户名通过校验,调整了正则锚点让这类输入被拒绝。

ai-pr.diffdiff · 45 lines
diff --git a/django/contrib/auth/validators.py b/django/contrib/auth/validators.pyindex b4878cfd45..1304f20a60 100644--- a/django/contrib/auth/validators.py+++ b/django/contrib/auth/validators.py@@ -7,7 +7,7 @@ from django.utils.translation import gettext_lazy as _  @deconstructible class ASCIIUsernameValidator(validators.RegexValidator):-    regex = r'^[\w.@+-]+$'+    regex = r'^[\w.@+-]+\Z'     message = _(         'Enter a valid username. This value may contain only English letters, '         'numbers, and @/./+/-/_ characters.'@@ -17,7 +17,7 @@ class ASCIIUsernameValidator(validators.RegexValidator):  @deconstructible class UnicodeUsernameValidator(validators.RegexValidator):-    regex = r'^[\w.@+-]+$'+    regex = r'^[\w.@+-]+\Z'     message = _(         'Enter a valid username. This value may contain only letters, '         'numbers, and @/./+/-/_ characters.'diff --git a/tests/auth_tests/test_validators.py b/tests/auth_tests/test_validators.pyindex 1e276ceef8..a9c0a86a4c 100644--- a/tests/auth_tests/test_validators.py+++ b/tests/auth_tests/test_validators.py@@ -237,7 +237,7 @@ class UsernameValidatorsTests(SimpleTestCase):         invalid_usernames = [             "o'connell", "عبد ال",             "zerowidth\u200Bspace", "nonbreaking\u00A0space",-            "en\u2013dash",+            "en\u2013dash", 'trailingnewline\u000A',         ]         v = validators.UnicodeUsernameValidator()         for valid in valid_usernames:@@ -250,7 +250,7 @@ class UsernameValidatorsTests(SimpleTestCase):      def test_ascii_validator(self):         valid_usernames = ['glenn', 'GLEnN', 'jean-marc']-        invalid_usernames = ["o'connell", 'Éric', 'jean marc', "أحمد"]+        invalid_usernames = ["o'connell", 'Éric', 'jean marc', "أحمد", 'trailingnewline\n']         v = validators.ASCIIUsernameValidator()         for valid in valid_usernames:             with self.subTest(valid=valid):