Merge pull request from GHSA-ffmh-x56j-9rc3

(cherry picked from commit a3908cc082465000a3afa4bed47418b6e02c14ed)

Author: bytestream

src/additional/url2.js

@@ -1416,7 +1416,7 @@ $.extend( $.validator, {
 			// https://gist.github.com/dperini/729294
 			// see also https://mathiasbynens.be/demo/url-regex
 			// modified to allow protocol-relative URLs
-			return this.optional( element ) || /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/i.test( value );
+			return this.optional( element ) || /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[^\]\[?\/<~#`!@$^&*()+=}|:";',>{ ]|%[0-9A-Fa-f]{2})+(?::(?:[^\]\[?\/<~#`!@$^&*()+=}|:";',>{ ]|%[0-9A-Fa-f]{2})*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/i.test( value );
 		},
 
 		// https://jqueryvalidation.org/date-method/

src/core.js

@@ -123,9 +123,9 @@ QUnit.test( "url2 (tld optional)", function( assert ) {
 	assert.ok( method( "http://www.føtex.dk/" ), "Valid url, danish unicode characters" );
 	assert.ok( method( "http://bösendorfer.de/" ), "Valid url, german unicode characters" );
 	assert.ok( method( "http://142.42.1.1" ), "Valid IP Address" );
+	assert.ok( method( "http://bassistance" ), "Valid URL (optional TLD)" );
+	assert.ok( method( "http://bassistance." ), "Valid URL (optional TLD)" );
 	assert.ok( !method( "http://192.168.8." ), "Invalid IP Address" );
-	assert.ok( method( "http://bassistance" ), "Invalid url" );
-	assert.ok( method( "http://bassistance." ), "Invalid url" );
 	assert.ok( !method( "http://bassistance,de" ), "Invalid url" );
 	assert.ok( !method( "http://bassistance;de" ), "Invalid url" );
 	assert.ok( !method( "http://.bassistancede" ), "Invalid url" );