[Django] #36886: URLField max_length cannot take advantage of supports_unlimited_charfield in DB backend

[Django]

#36886: URLField max_length cannot take advantage of supports_unlimited_charfield
in DB backend
-------------------------------------+-------------------------------------
Reporter: Joel D | Owner: Joel D Sleppy
Sleppy |
Type: | Status: assigned
Uncategorized |
Component: Database | Version: 6.0
layer (models, ORM) |
Severity: Normal | Keywords:
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
When using a DB backend that `supports_unlimited_charfield` (postgres,
sqlite), a `CharField` can omit `max_length` and allow arbitrarily long
values in the database. However `URLField`, which inherits from
`CharField`, forces the developer to pick a maximum length. For example,
this model class:

{{{#!python
class Thing(models.Model):
chars = models.CharField()
url = models.URLField()
}}}

Creates this table in postgres:

{{{
Table "public.app_thing"
Column | Type | Collation | Nullable |
Default
--------+------------------------+-----------+----------+----------------------------------
id | bigint | | not null | generated by
default as identity
chars | character varying | | not null |
url | character varying(200) | | not null |
}}}

And trying to set `url = models.URLField(max_length=None)` does not get
recognized as a change by `makemigrations`.

URLs can get quite long and it's an inconvenience to pick a maximum length
(and to defensively code against the possibility of it being violated).
I'd like to work on this improvement myself if there's any appetite for
it.

Possible changes:

- For backwards compatibility, continue to default `max_length` to `200`
but allow specifying `None` to have an unbounded field.
- Break backwards compatibility, changing behavior to match that of
`CharField`.
--
Ticket URL: <https://code.djangoproject.com/ticket/36886>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36886: URLField max_length cannot take advantage of supports_unlimited_charfield
in DB backend
-------------------------------------+-------------------------------------

Reporter: Joel D Sleppy | Owner: Joel D
| Sleppy
Type: Uncategorized | Status: assigned
Component: Database layer | Version: 6.0
(models, ORM) |
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Joel D Sleppy):

* needs_docs: 0 => 1
* needs_tests: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/36886#comment:1>

[Django]

#36886: URLField max_length cannot take advantage of supports_unlimited_charfield
in DB backend
-------------------------------------+-------------------------------------
Reporter: Joel D Sleppy | Owner: Joel D
| Sleppy

Type: New feature | Status: closed

Component: Database layer | Version: 6.0
(models, ORM) |

Severity: Normal | Resolution: wontfix

Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Natalia Bidart):

* resolution: => wontfix
* status: assigned => closed
* type: Uncategorized => New feature

Comment:

Hello Joel! Thank you for your ticket. I think I understand where you are
coming from, but Django provides general purpose, conservative primitives.
`URLField` is not just a thin alias for `CharField`; it is a higher level
abstraction with semantic expectations, including validation and
reasonable defaults. Requiring an explicit `max_length` is part of that
contract.

While URL length limits are not formally standardized, URLs do need
practical bounds. Allowing unbounded URL storage meaningfully increases
risk surface. Extremely long URLs are a known vector for denial of service
and resource exhaustion issues across layers (application, logging,
middleware, and more), and multiple historical CVEs across frameworks and
servers have been rooted in unbounded or insufficiently constrained string
inputs.

The existence of `supports_unlimited_charfield` at the database backend
level does not imply that all higher level field types should opt into
unbounded storage. `CharField` is intentionally low level. `URLField`
intentionally is not. From an API design perspective, allowing
`max_length=None` for `URLField` would blur the distinction between
`CharField` and `URLField`, weaken Django's defensive defaults, and
introduce subtle backwards compatibility and security review concerns for
limited practical gain. Developers who genuinely need unbounded URL-like
strings can already model that explicitly using `CharField` with specific
validators.

Given these considerations, the requirement for an explicit maximum length
on URLField is intentional and appropriate, even on backends that support
unlimited character fields.
--
Ticket URL: <https://code.djangoproject.com/ticket/36886#comment:2>

[Django]

#36886: URLField max_length cannot take advantage of supports_unlimited_charfield
in DB backend
-------------------------------------+-------------------------------------
Reporter: Joel D Sleppy | Owner: Joel D
| Sleppy
Type: New feature | Status: closed
Component: Database layer | Version: 6.0
(models, ORM) |
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 1
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Joel D Sleppy):

Cheers Natalia, thanks for the response. I can't say I understand fully,
but I'll keep building my intuition on these things.
--
Ticket URL: <https://code.djangoproject.com/ticket/36886#comment:3>