From 07ffee641174b4c43986cd516fc39eec2d91a90e Mon Sep 17 00:00:00 2001
From: Tim Graham <timograham@gmail.com>
Date: Thu, 11 Feb 2016 10:39:53 -0500
Subject: [PATCH] [1.9.x] Fixed #26204 -- Reallowed dashes in top-level domains
 for URLValidator.

Thanks Shai Berger for the review.

Backport of b1afebf882db5296cd9dcea26ee66d5250922e53 from master
---
 django/core/validators.py         | 9 ++++++++-
 docs/releases/1.8.10.txt          | 3 +++
 docs/releases/1.9.3.txt           | 3 +++
 tests/validators/invalid_urls.txt | 4 +++-
 tests/validators/valid_urls.txt   | 4 ++++
 5 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/django/core/validators.py b/django/core/validators.py
index 69cc76ffab..852ff49358 100644
--- a/django/core/validators.py
+++ b/django/core/validators.py
@@ -85,7 +85,14 @@ class URLValidator(RegexValidator):
     # Host patterns
     hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]*[a-z' + ul + r'0-9])?'
     domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]+(?<!-))*'
-    tld_re = r'\.(?:[a-z' + ul + r']{2,}|xn--[a-z0-9]+)\.?'
+    tld_re = (
+        '\.'                                # dot
+        '(?!-)'                             # can't start with a dash
+        '(?:[a-z' + ul + '-]{2,}'           # domain label
+        '|xn--[a-z0-9]+)'                   # or punycode label
+        '(?<!-)'                            # can't end with a dash
+        '\.?'                               # may have a trailing dot
+    )
     host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'
 
     regex = _lazy_re_compile(
diff --git a/docs/releases/1.8.10.txt b/docs/releases/1.8.10.txt
index b29000eb20..b63ae2abdc 100644
--- a/docs/releases/1.8.10.txt
+++ b/docs/releases/1.8.10.txt
@@ -21,3 +21,6 @@ Bugfixes
 * Fixed :class:`~django.contrib.postgres.fields.RangeField` and
   :class:`~django.contrib.postgres.fields.ArrayField` serialization with
   ``None`` values (:ticket:`26215`).
+
+* Reallowed dashes in top-level domain names of URLs checked by
+  ``URLValidator`` to fix a regression in Django 1.8 (:ticket:`26204`).
diff --git a/docs/releases/1.9.3.txt b/docs/releases/1.9.3.txt
index b250bb247e..a7c2b1eba5 100644
--- a/docs/releases/1.9.3.txt
+++ b/docs/releases/1.9.3.txt
@@ -34,3 +34,6 @@ Bugfixes
 
 * Fixed a crash when filtering by a ``Decimal`` in ``RawQuery``
   (:ticket:`26219`).
+
+* Reallowed dashes in top-level domain names of URLs checked by
+  ``URLValidator`` to fix a regression in Django 1.8 (:ticket:`26204`).
diff --git a/tests/validators/invalid_urls.txt b/tests/validators/invalid_urls.txt
index 12a1226359..f8711bf457 100644
--- a/tests/validators/invalid_urls.txt
+++ b/tests/validators/invalid_urls.txt
@@ -6,7 +6,7 @@ http://.com
 http://invalid-.com
 http://-invalid.com
 http://invalid.com-
-http://invalid.c-m
+http://invalid.-com
 http://inv-.alid-.com
 http://inv-.-alid.com
 file://localhost/path
@@ -33,6 +33,8 @@ http:// shouldfail.com
 :// should fail
 http://foo.bar/foo(bar)baz quux
 http://-error-.invalid/
+http://dashinpunytld.trailingdot.xn--.
+http://dashinpunytld.xn---
 http://-a.b.co
 http://a.b-.co
 http://a.-b.co
diff --git a/tests/validators/valid_urls.txt b/tests/validators/valid_urls.txt
index ad30811177..7732165f64 100644
--- a/tests/validators/valid_urls.txt
+++ b/tests/validators/valid_urls.txt
@@ -63,3 +63,7 @@ http://0.0.0.0/
 http://255.255.255.255
 http://224.0.0.0
 http://224.1.1.1
+http://dashintld.c-m
+http://multipledashintld.a-b-c
+http://evenmoredashintld.a---c
+http://dashinpunytld.xn---c