Allow umlaut domains for website addresses

[schneidr]

Checklist

• All new and existing tests are passing
• (If adding features:) I have added tests to cover my changes
• I have added an entry to CHANGES.rst because this is a user-facing change or an important bugfix
• I have written proper commit message(s)
  

What changes does this Pull Request introduce?

Changed website validation to allow domain names containing umlauts

Why is this necessary?

Resolves issue #951

[ix5]

Thank you for this PR. In my eyes, we should avoid introducing new dependencies.

The relevant part of the validators package is domain.py.
The package is MIT licensed and we can copy over that function into isso rather than having to load a whole package for a simple regex check.

[jelmer]

Please also add a test for the use case you're trying to address

[jelmer]

This comment seems odd to me - urlparse handles port numbers in URLs fine, so there must be something else going on?

[schneidr]

My bad, the reason for removing the port was not urlparse, it is validators.domain() which does not accept domain:port. I guess I could clean this up by using hostname instead of netloc, but if the complete URL is supposed to be validated these lines are most probably not staying anyway.

[schneidr]

I did add my test case in test_comments.py.

[jelmer]

Do we actually need to check the domain name at all?

[ix5]

Do we actually need to check the domain name at all?

Because IIRC the website is inserted as a link (if given), we should make sure it is valid.

If we skipped the validity check, I'm not sure that the markup escaping would catch e.g. someone entering malicious Javascript foo</a><span onclick='evil.function()'></span>.

[jelmer]

Do we actually need to check the domain name at all?

Because IIRC the website is inserted as a link (if given), we should make sure it is valid.

If we skipped the validity check, I'm not sure that the markup escaping would catch e.g. someone entering malicious Javascript foo</a><span onclick='evil.function()'></span>.

That seems like an argument for just fixing the markup escaping to me...

[schneidr]

Do we actually need to check the domain name at all?

Because IIRC the website is inserted as a link (if given), we should make sure it is valid.

If we skipped the validity check, I'm not sure that the markup escaping would catch e.g. someone entering malicious Javascript foo</a><span onclick='evil.function()'></span>.

So, the goal is to actually check the complete entered URL, not only if the domain is valid, as I assumed?

[jelmer]

Sorry for the delay; let's just merge this, since it's clearly an improvement over the current situation. Ideally, we'd be moving away from checking for valid domains to checking for malicious things though.