fix: return False instead of raising on a malformed authority

urlparse raises ValueError on "https://[::1", and long_url reaches the
validator as a plain str, so the exception escaped as a 500 on the
shorten endpoints rather than a clean rejection.

Author: Zingzy

shared/validators.py

@@ -50,9 +50,15 @@ def validate_url(
             loops. Matching is host-scoped: a destination that merely
             mentions the name in its path or query is not a loop.
     """
+    # urlparse raises on a malformed IPv6 authority ("https://[::1"), and
+    # long_url reaches here as a plain str, so an unguarded parse escapes as
+    # a 500 on the shorten endpoints instead of a 400.
+    try:
+        parsed = urlparse(url)
+    except ValueError:
+        return False
     # Scheme allowlist defends against ftp/file/data/etc even if the
     # validators package widens its accepted schemes upstream.
-    parsed = urlparse(url)
     if parsed.scheme not in _ALLOWED_URL_SCHEMES:
         return False
     if not _validators.url(url, skip_ipv4_addr=True, skip_ipv6_addr=True):

tests/unit/shared/test_validators.py

@@ -24,6 +24,7 @@
         ("https://www.spoo.me/abc", False),  # subdomain of a blocked host
         ("not-a-url", False),
         ("http://192.168.1.1/path", False),  # IPv4 skipped by validator
+        ("https://[::1", False),  # urlparse raises on this, must not escape
         # Host-scoped: a foreign destination that merely mentions the blocked
         # name in its path, query or fragment is not a redirect loop. The
         # dashboard hit this shortening a PostHog analytics URL filtered on
@@ -44,6 +45,7 @@
         "self_ref_subdomain",
         "plain_text",
         "ipv4",
+        "malformed_ipv6_authority",
         "foreign_host_mentions_in_query",
         "foreign_host_mentions_in_path",
         "foreign_host_mentions_in_fragment",