Question

I have a model like the following:

class Page(ContentBase):    
    url_slug = models.SlugField()

Per the SlugField docs, slugfields are ‘numbers, letters, underscores and hyphens’. However I seem to be able to set bad slugs which have characters outside that spec:

page = Page.objects.get(id=872)
page.url_slug = '&*()&*(*(Y*'    
page.save()

In [26]: page.url_slug
Out[26]: '&*()&*(*(Y*'

Why is this? Should the SlugFields actually be validating its input per the docs, or do I need to do this myself? Why does the documentation state the limit when I seem to be able to avoid it so easily?

Answer 1

SlugField’s validation works through it’s matching forms.SlugField:

class SlugField(CharField):
    default_error_messages = {
        'invalid': _(u"Enter a valid 'slug' consisting of letters, numbers,"
                     u" underscores or hyphens."),
    }
    default_validators = [validators.validate_slug]

If you modify it manually without a form, refer to django.core.validators.validate_slug:

slug_re = re.compile(r'^[-\w]+$')
validate_slug = RegexValidator(slug_re, _(u"Enter a valid 'slug' consisting of letters, numbers, underscores or hyphens."), 'invalid')