Reject domains longer than 253 characters

domain() validated each label (<= 63 chars) but never checked the total
length, so a long multi-label name (e.g. 256 chars of valid labels) was
accepted, and hostname() inherited the same gap. Enforce the RFC 1035
253-character limit on the textual domain name.

Fixes #413

Author: eeshsaxena

src/validators/domain.py

@@ -76,6 +76,11 @@ def domain(
     if not value:
         return False
 
+    # The textual representation of a domain name is limited to 253 characters
+    # (RFC 1035), regardless of the individual label lengths.
+    if len(value.rstrip(".")) > 253:
+        return False
+
     if consider_tld and not _IanaTLD.check(value.rstrip(".").rsplit(".", 1)[-1].upper()):
         return False
 

tests/test_domain.py

@@ -84,6 +84,18 @@ def test_returns_failed_validation_on_invalid_domain(value: str, rfc_1034: bool,
     assert isinstance(domain(value, rfc_1034=rfc_1034, rfc_2782=rfc_2782), ValidationError)
 
 
+def test_returns_failed_validation_on_too_long_domain():
+    """A domain over 253 characters is invalid regardless of label lengths."""
+    label = "a" * 49
+    too_long = ".".join([label] * 5) + ".aaaaa"  # 255 characters, each label <= 63
+    assert len(too_long) > 253
+    assert isinstance(domain(too_long), ValidationError)
+
+    at_limit = ".".join([label] * 5) + ".aaa"  # exactly 253 characters
+    assert len(at_limit) == 253
+    assert domain(at_limit)
+
+
 @pytest.mark.parametrize(
     ("value", "consider_tld", "rfc_1034", "rfc_2782"),
     [