URLValidator ignores an explicit empty scheme allowlist

Open Beginner friendly
#2,393 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@IlyaKhalafi is already working on this.

Since Nov 2, 2026.

  • #2394 by @IlyaKhalafi — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
backend

Research direction

The bug is in URLValidator from tortoise.validators; start in that class and look at how allowed_schemes is checked, since an empty list is currently treated like an omitted argument. Change the fallback so only None selects the default schemes, then run the reproduction snippet from the issue. Done means URLValidator(allowed_schemes=[]) raises InvalidScheme for https://example.com, and the default behaviour for an omitted or None argument is unchanged.

Written by the indexing model from the issue text.

Description

URLValidator falls back to the default schemes when allowed_schemes is an empty list. This prevents callers from configuring it to reject every URL scheme.

Reproduction

from tortoise.validators import URLValidator

URLValidator(allowed_schemes=[])("https://example.com")

Expected behavior is an InvalidScheme error. The default schemes should apply when the argument is omitted or None.

Dominant language
Python
Stars
5.6k
Forks
540
Avg merge
4d 10h
Merged PRs (30d)
31

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tortoise/tortoise-orm

All issues in tortoise/tortoise-orm

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.