Align HTTP basic auth regex of EnhancedURLValidator with Django's URLValidator #109

New Issue

MrUnknownDE · 2026-04-05T16:21:43+02:00

MrUnknownDE commented

2026-04-05 16:21:43 +02:00

Originally created by @pheus on 3/20/2026

NetBox version

v4.5.5

Feature type

Change to existing functionality

Proposed functionality

The EnhancedURLValidator currently uses \S+(?:\S*)? for matching HTTP basic authentication in URLs. This is more permissive than Django's upstream URLValidator, which uses [^\s:@/]+(?::[^\s:@/]*)? (explicitly excluding :, @, and / from the user and password segments).

I'd like to propose aligning NetBox's auth regex with Django's stricter pattern to prevent ambiguous or malformed URLs from passing validation.

Specifically, in netbox/utilities/validators.py:

# Current
r'(?:\S+(?:\S*)?@)?'

# Proposed
r'(?:[^\s:@/]+(?::[^\s:@/]*)?@)?'

Since this tightens what's considered valid, some previously accepted URLs with unusual characters in the auth portion would be rejected. This makes it a breaking change best suited for a minor release.

Use case

The current permissive pattern can match URLs that are technically malformed. For example, URLs where :, @, or / appear unexpectedly in the credentials portion. Aligning with Django's pattern improves input validation reliability and reduces the chance of downstream issues when URLs are parsed by other tools or libraries.

Database changes

None.

External dependencies

None.

*Originally created by @pheus on 3/20/2026* ### NetBox version v4.5.5 ### Feature type Change to existing functionality ### Proposed functionality The `EnhancedURLValidator` currently uses `\S+(?:\S*)?` for matching HTTP basic authentication in URLs. This is more permissive than Django's upstream `URLValidator`, which uses `[^\s:@/]+(?::[^\s:@/]*)?` (explicitly excluding `:`, `@`, and `/` from the user and password segments). I'd like to propose aligning NetBox's auth regex with Django's stricter pattern to prevent ambiguous or malformed URLs from passing validation. Specifically, in `netbox/utilities/validators.py`: ```python # Current r'(?:\S+(?:\S*)?@)?' # Proposed r'(?:[^\s:@/]+(?::[^\s:@/]*)?@)?' ``` Since this tightens what's considered valid, some previously accepted URLs with unusual characters in the auth portion would be rejected. This makes it a breaking change best suited for a minor release. ### Use case The current permissive pattern can match URLs that are technically malformed. For example, URLs where `:`, `@`, or `/` appear unexpectedly in the credentials portion. Aligning with Django's pattern improves input validation reliability and reduces the chance of downstream issues when URLs are parsed by other tools or libraries. ### Database changes None. ### External dependencies None.

MrUnknownDE closed this issue

2026-04-05 16:21:43 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label complexity: low complexity: low complexity: low complexity: low complexity: low complexity: low complexity: low netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature type: feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#109

Align HTTP basic auth regex of EnhancedURLValidator with Django's URLValidator #109