Skip to content

Force 'https://www.python.org/' URLs for ReleaseFile properties#2947

Merged
JacobCoffee merged 5 commits into
python:mainfrom
sethmlarson:url-hardening
Feb 25, 2026
Merged

Force 'https://www.python.org/' URLs for ReleaseFile properties#2947
JacobCoffee merged 5 commits into
python:mainfrom
sethmlarson:url-hardening

Conversation

@sethmlarson

Copy link
Copy Markdown
Contributor

Description

Adds a new CheckConstraint that forces all URLField fields on ReleaseFile model to not accept URLs that don't start with http(s)://www.python.org/.

@hugovk

hugovk commented Feb 25, 2026

Copy link
Copy Markdown
Member

Locally, if I change the URL for a file of an existing release to www.example.com/[etc], clicking save correctly gives an error:

Constraint “only_python_dot_org_urls” is violated.

image

Also when creating a new release with a file.

But can we make that error more descriptive?

I don't need to know what a "constraint" is; tell me what's not allowed and what is.

@sethmlarson

sethmlarson commented Feb 25, 2026

Copy link
Copy Markdown
Contributor Author

Done in 93e2795, the new message is "All file URLs must begin with 'https://www.python.org/'".

@hugovk hugovk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

Comment thread apps/downloads/models.py
@sethmlarson

Copy link
Copy Markdown
Contributor Author

FYI: The Lint action failed to install, I ran make lint locally and received no errors.

@hugovk

hugovk commented Feb 25, 2026

Copy link
Copy Markdown
Member
@JacobCoffee JacobCoffee enabled auto-merge (squash) February 25, 2026 21:22
@JacobCoffee JacobCoffee disabled auto-merge February 25, 2026 21:23
@JacobCoffee JacobCoffee merged commit a59280c into python:main Feb 25, 2026
5 of 6 checks passed
@sethmlarson sethmlarson deleted the url-hardening branch February 25, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants