Reject all-numeric IDN top-level labels in domain()

RFC 1123 (2.1) and RFC 3696 (2) require the top-level label to not be
all-numeric, so a host name never has the dotted-decimal form #.#.#.#.
domain() enforced this by requiring the encoded TLD to end in a letter,
but a label of non-ASCII digits encodes to a letter-final A-label, so
"10.0.0.\u0661" (Arabic-Indic one) validated as a domain, and through
hostname() and url() as a host that looks like a private IPv4 address.

Reject a value whose last label is made only of decimal digits from any
script.

Author: nandgator

src/validators/domain.py

@@ -101,6 +101,11 @@ def domain(
         if _relies_on_idna_mapping(value):
             return False
 
+        if value.rstrip(".").rsplit(".", 1)[-1].isdecimal():
+            # ref: RFC 1123 (2.1) and RFC 3696 (2), a TLD is not all-numeric. An
+            # all-digit IDN label like "\u0661" is, but encodes to a letter-final A-label.
+            return False
+
         service_record = r"_" if rfc_2782 else ""
         trailing_dot = r"\.?$" if rfc_1034 else r"$"
 

tests/test_domain.py

@@ -203,3 +203,29 @@ def test_returns_failed_validation_on_idna_mapped_lookalike(value: str, consider
 def test_returns_true_on_idn_without_lookalike_mapping(value: str):
     """Test returns true on internationalized names that need no lossy mapping."""
     assert domain(value)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "10.0.0.\u0661",  # Arabic-Indic one; looks like 10.0.0.1
+        "example.\u0661\u0662\u0663",
+        "example.\u0968",  # Devanagari two
+        "123.5.77.\u06688",  # Arabic-Indic and ASCII digits
+    ],
+)
+@pytest.mark.parametrize("rfc_1034", [False, True])
+def test_returns_failed_validation_on_all_numeric_idn_tld(value: str, rfc_1034: bool):
+    """Test returns failed validation on a TLD made only of digits from any script."""
+    assert isinstance(domain(value, rfc_1034=rfc_1034), ValidationError)
+
+
+def test_returns_failed_validation_on_all_numeric_idn_tld_with_trailing_dot():
+    """Test returns failed validation on an all-numeric IDN TLD followed by a trailing dot."""
+    assert isinstance(domain("example.\u0661.", rfc_1034=True), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["\u0661\u0662.com", "example.\u0661a", "1.example.com"])
+def test_returns_true_on_digits_outside_or_mixed_in_tld(value: str):
+    """Test returns true when digits appear only in other labels or alongside letters."""
+    assert domain(value)

tests/test_hostname.py

@@ -139,3 +139,9 @@ def test_returns_failed_validation_on_non_ascii_simple_hostname(value: str):
 def test_returns_failed_validation_on_idna_mapped_lookalike_hostname(value: str):
     """Test returns failed validation on hostnames that only IDNA 2003 mapping makes valid."""
     assert isinstance(hostname(value), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["10.0.0.\u0661", "123.5.77.\u06688:31000"])
+def test_returns_failed_validation_on_ipv4_lookalike_hostname(value: str):
+    """Test returns failed validation on dotted names whose last label is non-ASCII digits."""
+    assert isinstance(hostname(value), ValidationError)

tests/test_url.py

@@ -266,3 +266,10 @@ def test_url_accepts_percent_encoded_controls(encoded: str, template: str):
 def test_returns_failed_validation_on_idna_mapped_lookalike_url(value: str):
     """Test returns failed validation on url hosts that only IDNA 2003 mapping makes valid."""
     assert isinstance(url(value, simple_host=True), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["http://10.0.0.\u0661/", "https://192.168.1.\u0661:8080/"])
+@pytest.mark.parametrize("private", [None, False, True])
+def test_returns_failed_validation_on_ipv4_lookalike_url(value: str, private: Optional[bool]):
+    """Test returns failed validation on hosts that only look like an IPv4 address."""
+    assert isinstance(url(value, private=private), ValidationError)