Skip to content

Force 'https://www.python.org/' URLs for ReleaseFile properties#2947

Merged
JacobCoffee merged 5 commits intopython:mainfrom
sethmlarson:url-hardening
Feb 25, 2026
Merged

Force 'https://www.python.org/' URLs for ReleaseFile properties#2947
JacobCoffee merged 5 commits intopython:mainfrom
sethmlarson:url-hardening

Conversation

@sethmlarson
Copy link
Contributor

Description

Adds a new CheckConstraint that forces all URLField fields on ReleaseFile model to not accept URLs that don't start with http(s)://www.python.org/.

@hugovk
Copy link
Member

hugovk commented Feb 25, 2026

Locally, if I change the URL for a file of an existing release to www.example.com/[etc], clicking save correctly gives an error:

Constraint “only_python_dot_org_urls” is violated.

image

Also when creating a new release with a file.

But can we make that error more descriptive?

I don't need to know what a "constraint" is; tell me what's not allowed and what is.

@sethmlarson
Copy link
Contributor Author

sethmlarson commented Feb 25, 2026

Done in 93e2795, the new message is "All file URLs must begin with 'https://www.python.org/'".

Copy link
Member

@hugovk hugovk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@sethmlarson
Copy link
Contributor Author

FYI: The Lint action failed to install, I ran make lint locally and received no errors.

@hugovk
Copy link
Member

hugovk commented Feb 25, 2026

Re-ran lint and passed: https://github.com/python/pythondotorg/actions/runs/22413902653/job/64899885730

@JacobCoffee JacobCoffee enabled auto-merge (squash) February 25, 2026 21:22
@JacobCoffee JacobCoffee disabled auto-merge February 25, 2026 21:23
@JacobCoffee JacobCoffee merged commit a59280c into python:main Feb 25, 2026
5 of 6 checks passed
@sethmlarson sethmlarson deleted the url-hardening branch February 25, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants