Re: [Django] #36923: URLField.to_python() mangles mailto: URLs

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Natalia <124304+nessita@…>):

In [changeset:"951ffb3832cd83ba672c1e3deae2bda128eb9cca" 951ffb38]:
{{{#!CommitTicketReference repository=""
revision="951ffb3832cd83ba672c1e3deae2bda128eb9cca"
Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of `urlsplit()` in `URLField.to_python()` was replaced with
`str.partition(":")` for URL scheme detection. On Windows, `urlsplit()`
performs Unicode normalization which is slow for certain characters,
making `URLField` vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobty...@gmail.com>
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:9>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Natalia <124304+nessita@…>):

In [changeset:"b1444d9acf43db9de96e0da2b4737ad56af0eb76" b1444d9a]:
{{{#!CommitTicketReference repository=""
revision="b1444d9acf43db9de96e0da2b4737ad56af0eb76"
[6.0.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of `urlsplit()` in `URLField.to_python()` was replaced with
`str.partition(":")` for URL scheme detection. On Windows, `urlsplit()`
performs Unicode normalization which is slow for certain characters,
making `URLField` vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobty...@gmail.com>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:10>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Natalia <124304+nessita@…>):

In [changeset:"4d3c184686626d224d9a87451410ecf802b41f7c" 4d3c184]:
{{{#!CommitTicketReference repository=""
revision="4d3c184686626d224d9a87451410ecf802b41f7c"
[5.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of `urlsplit()` in `URLField.to_python()` was replaced with
`str.partition(":")` for URL scheme detection. On Windows, `urlsplit()`
performs Unicode normalization which is slow for certain characters,
making `URLField` vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobty...@gmail.com>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.
}}}
--

Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:11>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Natalia <124304+nessita@…>):

In [changeset:"b3e8ec8cc310489fe80174b14b11edb970d682ea" b3e8ec8c]:
{{{#!CommitTicketReference repository=""
revision="b3e8ec8cc310489fe80174b14b11edb970d682ea"
[4.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

This simplicaftion mitigates a potential DoS in URLField on Windows. The
usage of `urlsplit()` in `URLField.to_python()` was replaced with
`str.partition(":")` for URL scheme detection. On Windows, `urlsplit()`
performs Unicode normalization which is slow for certain characters,
making `URLField` vulnerable to DoS via specially crafted POST payloads.

Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger
for the review.

Refs #36923.

Co-authored-by: Jacob Walls <jacobty...@gmail.com>

Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.
}}}
--

Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:12>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Natalia Bidart):

The security release I just published solves this issue, though I
intentionally did not add tests for this case to avoid polluting a focused
security patch. This means that the work needed to close this ticket is
proper tests for the reported cases, which should all pass without any
code changes AFAIU.
--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:13>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:
Keywords: mailto urlfield | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* has_patch: 0 => 1

Comment:

[https://github.com/django/django/pull/20823 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:14>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart
Type: Bug | Status: assigned
Component: Forms | Version: 5.2
Severity: Normal | Resolution:

Keywords: mailto urlfield | Triage Stage: Ready for
| checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:15>

[Django]

#36923: URLField.to_python() mangles mailto: URLs
-------------------------------------+-------------------------------------
Reporter: waveywhite | Owner: Natalia
| Bidart

Type: Bug | Status: closed
Component: Forms | Version: 5.2
Severity: Normal | Resolution: fixed

Keywords: mailto urlfield | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by nessita <124304+nessita@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"4b6c998301fedec279ec97b6547e67c3e88b7ff0" 4b6c998]:
{{{#!CommitTicketReference repository=""
revision="4b6c998301fedec279ec97b6547e67c3e88b7ff0"
Fixed #36923 -- Added tests for non-hierarchical URI schemes in
URLField.to_python().

Follow up to 951ffb3832cd83ba672c1e3deae2bda128eb9cca.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/36923#comment:16>