Fixed #25620 -- Made URLValidator prohibit URLs with consecutive dots in the domain section.

django/core/validators.py

@@ -84,7 +84,7 @@ class URLValidator(RegexValidator):
 
     # Host patterns
     hostname_re = r'[a-z' + ul + r'0-9](?:[a-z' + ul + r'0-9-]*[a-z' + ul + r'0-9])?'
-    domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]*(?<!-))*'
+    domain_re = r'(?:\.(?!-)[a-z' + ul + r'0-9-]+(?<!-))*'
     tld_re = r'\.(?:[a-z' + ul + r']{2,}|xn--[a-z0-9]+)\.?'
     host_re = '(' + hostname_re + domain_re + tld_re + '|localhost)'
 

docs/releases/1.8.6.txt

@@ -44,3 +44,7 @@ Bugfixes
 
 * Added a helpful error message when Django and South migrations exist in the
   same directory (:ticket:`25618`).
+
+* Fixed a regression in ``URLValidator`` that allowed URLs with consecutive
+  dots in the domain section (like ``http://example..com/``) to pass
+  (:ticket:`25620`).

tests/validators/invalid_urls.txt

@@ -49,3 +49,4 @@ http://.www.foo.bar./
 http://[::1:2::3]:8080/
 http://[]
 http://[]:8080
+http://example..com/