Merge branch 'master' into fix-email-tagged-ipv6-literals

Author: pabszero

.github/workflows/sast.yaml

@@ -11,11 +11,20 @@ on:
 jobs:
   sast:
     permissions:
-      security-events: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - name: Bandit
-        uses: PyCQA/bandit-action@v1
+      # checkout repository
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      # set up uv and a specific python version
+      - name: Set up uv with Python v3.14
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          targets: src/validators
-          exclude: .github,.pytest_cache,.venv,.vscode,site,tests
+          python-version: "3.14"
+          enable-cache: true
+      # bandit, pinned by uv.lock and configured in pyproject.toml
+      - name: Install 'sast' dependencies
+        run: uv sync --locked --group sast
+      - name: Bandit
+        run: uv run --no-sync bandit -c pyproject.toml -r src/validators

src/validators/_tld.txt

@@ -1,4 +1,4 @@
-# Version 2024052400, Last Updated Fri May 24 07:07:01 2024 UTC
+# Version 2026102100, Last Updated Wed Oct 21 07:07:01 2026 UTC
 AAA
 AARP
 ABB
@@ -118,7 +118,6 @@ BE
 BEATS
 BEAUTY
 BEER
-BENTLEY
 BERLIN
 BEST
 BESTBUY
@@ -297,7 +296,6 @@ CY
 CYMRU
 CYOU
 CZ
-DABUR
 DAD
 DANCE
 DATA
@@ -346,7 +344,6 @@ DOWNLOAD
 DRIVE
 DTV
 DUBAI
-DUNLOP
 DUPONT
 DURBAN
 DVAG
@@ -489,7 +486,6 @@ GODADDY
 GOLD
 GOLDPOINT
 GOLF
-GOO
 GOODYEAR
 GOOG
 GOOGLE
@@ -623,12 +619,10 @@ JP
 JPMORGAN
 JPRS
 JUEGOS
-JUNIPER
 KAUFEN
 KDDI
 KE
 KERRYHOTELS
-KERRYLOGISTICS
 KERRYPROPERTIES
 KFH
 KG
@@ -660,7 +654,6 @@ LA
 LACAIXA
 LAMBORGHINI
 LAMER
-LANCASTER
 LAND
 LANDROVER
 LANXESS
@@ -692,7 +685,6 @@ LIMITED
 LIMO
 LINCOLN
 LINK
-LIPSY
 LIVE
 LIVING
 LK
@@ -748,6 +740,7 @@ MEME
 MEMORIAL
 MEN
 MENU
+MERCK
 MERCKMSD
 MG
 MH
@@ -802,7 +795,6 @@ NA
 NAB
 NAGOYA
 NAME
-NATURA
 NAVY
 NBA
 NC
@@ -918,7 +910,6 @@ POLITIE
 PORN
 POST
 PR
-PRAMERICA
 PRAXI
 PRESS
 PRIME
@@ -952,7 +943,6 @@ REALTOR
 REALTY
 RECIPES
 RED
-REDSTONE
 REDUMBRELLA
 REHAB
 REISE
@@ -1039,7 +1029,6 @@ SG
 SH
 SHANGRILA
 SHARP
-SHAW
 SHELL
 SHIA
 SHIKSHA
@@ -1243,6 +1232,7 @@ WATCH
 WATCHES
 WEATHER
 WEATHERCHANNEL
+WEB
 WEBCAM
 WEBER
 WEBSITE
@@ -1260,7 +1250,6 @@ WINDOWS
 WINE
 WINNERS
 WME
-WOLTERSKLUWER
 WOODSIDE
 WORK
 WORKS

src/validators/crypto_addresses/btc_address.py

@@ -50,7 +50,7 @@ def btc_address(value: str, /):
 
     return (
         # segwit pattern
-        re.compile(r"^(bc|tb)[0-3][02-9ac-hj-np-z]{14,74}$").match(value)
+        re.compile(r"^(bc|tb)[0-3][02-9ac-hj-np-z]{14,74}$").fullmatch(value)
         if value[:2] in ("bc", "tb")
         else _validate_old_btc_address(value)
     )

src/validators/crypto_addresses/eth_address.py

@@ -59,6 +59,6 @@ def eth_address(value: str, /):
     if not value:
         return False
 
-    return re.compile(r"^0x[0-9a-f]{40}$|^0x[0-9A-F]{40}$").match(
+    return re.compile(r"^0x[0-9a-f]{40}$|^0x[0-9A-F]{40}$").fullmatch(
         value
     ) or _validate_eth_checksum_address(value)

src/validators/domain.py

@@ -4,7 +4,9 @@
 from os import environ
 from pathlib import Path
 import re
+from stringprep import in_table_b1
 from typing import Optional, Set
+from unicodedata import normalize
 
 # local
 from .utils import validator
@@ -37,6 +39,22 @@ def check(cls, tld: str):
         return tld in cls._full_cache
 
 
+def _relies_on_idna_mapping(value: str):
+    """Return whether `value` only becomes a valid name through IDNA 2003 mapping.
+
+    Python's `idna` codec implements IDNA 2003 (RFC 3490), whose nameprep step
+    (RFC 3491) drops invisible characters (RFC 3454, table B.1), folds
+    compatibility characters such as fullwidth letters to ASCII, and treats
+    U+3002 and similar dots as label separators. A value that needs any of
+    these only looks like the name it encodes to, e.g. "example.com" written
+    with fullwidth letters.
+    """
+    return not value.isascii() and (
+        normalize("NFKC", value) != value
+        or any(in_table_b1(char) or char in "\u3002\uff0e\uff61" for char in value)
+    )
+
+
 @validator
 def domain(
     value: str, /, *, consider_tld: bool = False, rfc_1034: bool = False, rfc_2782: bool = False
@@ -76,10 +94,15 @@ def domain(
     if not value:
         return False
 
-    if consider_tld and not _IanaTLD.check(value.rstrip(".").rsplit(".", 1)[-1].upper()):
-        return False
-
     try:
+        if _relies_on_idna_mapping(value):
+            return False
+
+        if value.rstrip(".").rsplit(".", 1)[-1].isdecimal():
+            # ref: RFC 1123 (2.1) and RFC 3696 (2), a TLD is not all-numeric. An
+            # all-digit IDN label like "\u0661" is, but encodes to a letter-final A-label.
+            return False
+
         service_record = r"_" if rfc_2782 else ""
         trailing_dot = r"\.?$" if rfc_1034 else r"$"
 
@@ -88,6 +111,11 @@ def domain(
             # ref: RFC 1035, presentation form is limited to 253 characters
             return False
 
+        # IANA lists IDN TLDs in their ASCII (punycode) form,
+        # so look up the encoded TLD, not the raw one.
+        if consider_tld and not _IanaTLD.check(encoded.rstrip(".").rsplit(".", 1)[-1].upper()):
+            return False
+
         return not re.search(r"\s|__+", value) and re.match(
             # First character of the domain
             rf"^(?:[a-z0-9{service_record}]"

src/validators/encoding.py

@@ -11,6 +11,8 @@
 def base16(value: str, /):
     """Return whether or not given value is a valid base16 encoding.
 
+    Each encoded byte requires two hexadecimal characters.
+
     Examples:
         >>> base16('a3f4b2')
         True
@@ -25,7 +27,7 @@ def base16(value: str, /):
         (Literal[True]): If `value` is a valid base16 encoding.
         (ValidationError): If `value` is an invalid base16 encoding.
     """
-    return re.fullmatch(r"^[0-9A-Fa-f]+$", value) if value else False
+    return re.fullmatch(r"(?:[0-9A-Fa-f]{2})+", value) if value else False
 
 
 @validator
@@ -46,7 +48,15 @@ def base32(value: str, /):
         (Literal[True]): If `value` is a valid base32 encoding.
         (ValidationError): If `value` is an invalid base32 encoding.
     """
-    return re.fullmatch(r"^[A-Z2-7]+=*$", value) if value else False
+    return (
+        re.fullmatch(
+            r"(?:[A-Z2-7]{8})*(?:[A-Z2-7]{2}(?:={6})?|[A-Z2-7]{4}(?:={4})?|"
+            r"[A-Z2-7]{5}(?:={3})?|[A-Z2-7]{7}=?)?",
+            value,
+        )
+        if value
+        else False
+    )
 
 
 @validator

src/validators/hostname.py

@@ -26,21 +26,23 @@ def _simple_hostname_regex():
     """Simple hostname validation regex."""
     # {0,59} because two characters are already matched at
     # the beginning and at the end, making the range {1, 61}
-    return re.compile(r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE)
+    return re.compile(
+        r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE | re.ASCII
+    )
 
 
 def _port_validator(value: str):
     """Returns host segment if port is valid."""
     if value.count("]:") == 1:
         # with ipv6
         host_seg, port_seg = value.rsplit(":", 1)
-        if _port_regex().match(f":{port_seg}"):
+        if _port_regex().fullmatch(f":{port_seg}"):
             return host_seg.lstrip("[").rstrip("]")
 
     if value.count(":") == 1:
         # with ipv4 or simple hostname
         host_seg, port_seg = value.rsplit(":", 1)
-        if _port_regex().match(f":{port_seg}"):
+        if _port_regex().fullmatch(f":{port_seg}"):
             return host_seg
 
     return None
@@ -120,7 +122,7 @@ def _matches_simple_hostname(host: str):
         # hostname, not only on the dotted names handled by `domain()`.
         if rfc_1034 and host.endswith("."):
             host = host[:-1]
-        return _simple_hostname_regex().match(host)
+        return _simple_hostname_regex().fullmatch(host)
 
     if may_have_port and (host_seg := _port_validator(value)):
         return (

src/validators/i18n/es.py

@@ -17,7 +17,7 @@ def _nif_nie_validation(value: str, number_by_letter: Dict[str, str]):
     # letter to the corresponding digit
     numbers = number_by_letter.get(value[0], value[0]) + value[1:8]
     # doi[8] is control
-    return numbers.isdigit() and value[8] == table[int(numbers) % 23]
+    return numbers.isascii() and numbers.isdigit() and value[8] == table[int(numbers) % 23]
 
 
 @validator
@@ -58,7 +58,7 @@ def es_cif(value: str, /):
     first_chr = value[0]
     doi_body = value[1:8]
     control = value[8]
-    if not doi_body.isdigit():
+    if not doi_body.isascii() or not doi_body.isdigit():
         return False
     res = (
         10

src/validators/i18n/fi.py

@@ -1,6 +1,7 @@
 """Finland."""
 
 # standard
+from datetime import date
 from functools import lru_cache
 import re
 
@@ -22,10 +23,10 @@ def _ssn_pattern(ssn_check_marks: str):
         (?P<date>(0[1-9]|[1-2]\d|3[01])
         (0[1-9]|1[012])
         (\d{{2}}))
-        [ABCDEFYXWVU+-]
+        (?P<century>[ABCDEFYXWVU+-])
         (?P<serial>(\d{{3}}))
         (?P<checksum>[{check_marks}])$""".format(check_marks=ssn_check_marks),
-        re.VERBOSE,
+        re.VERBOSE | re.ASCII,
     )
 
 
@@ -95,6 +96,9 @@ def fi_ssn(value: str, /, *, allow_temporal_ssn: bool = True):
     if not (result := re.fullmatch(_ssn_pattern(ssn_check_marks), value)):
         return False
     gd = result.groupdict()
+    century = 1800 if gd["century"] == "+" else 2000 if gd["century"] in "ABCDEF" else 1900
+    birth_date = gd["date"]
+    date(century + int(birth_date[4:]), int(birth_date[2:4]), int(birth_date[:2]))
     checksum = int(gd["date"] + gd["serial"])
     return (
         int(gd["serial"]) >= 2

src/validators/i18n/fr.py

@@ -20,7 +20,7 @@ def _ssn_pattern():
         r"\s(\d{2,3})"  # town of birth
         r"\s(\d{3})"  # registration number
         r"(?:\s(\d{2}))?$",  # control key (may or may not be provided)
-        re.VERBOSE,
+        re.VERBOSE | re.ASCII,
     )