From 33ce416436fdc1e6dffcc8d1ee824261861adabf Mon Sep 17 00:00:00 2001
From: ubeddulla khan <ubed@bugqore.com>
Date: Sat, 4 Jul 2026 13:42:02 +0530
Subject: [PATCH] anchor host label validators with \Z to reject trailing
 newline

---
 botocore/endpoint_provider.py |  2 +-
 botocore/handlers.py          |  2 +-
 botocore/serialize.py         |  2 +-
 botocore/utils.py             |  6 ++++--
 tests/unit/test_utils.py      | 13 +++++++++++++
 5 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/botocore/endpoint_provider.py b/botocore/endpoint_provider.py
index 69f9a11a08..08d03a18b7 100644
--- a/botocore/endpoint_provider.py
+++ b/botocore/endpoint_provider.py
@@ -44,7 +44,7 @@
 TEMPLATE_STRING_RE = re.compile(r"\{[a-zA-Z#]+\}")
 GET_ATTR_RE = re.compile(r"(\w*)\[(\d+)\]")
 VALID_HOST_LABEL_RE = re.compile(
-    r"^(?!-)[a-zA-Z\d-]{1,63}(?<!-)$",
+    r"^(?!-)[a-zA-Z\d-]{1,63}(?<!-)\Z",
 )
 CACHE_SIZE = 100
 # S3 endpoint ruleset parameters that are defined but not currently referenced.
diff --git a/botocore/handlers.py b/botocore/handlers.py
index d0eec0a150..80db6cb95d 100644
--- a/botocore/handlers.py
+++ b/botocore/handlers.py
@@ -1003,7 +1003,7 @@ def __call__(self, client, **kwargs):
 class HeaderToHostHoister:
     """Takes a header and moves it to the front of the hoststring."""
 
-    _VALID_HOSTNAME = re.compile(r'(?!-)[a-z\d-]{1,63}(?<!-)$', re.IGNORECASE)
+    _VALID_HOSTNAME = re.compile(r'(?!-)[a-z\d-]{1,63}(?<!-)\Z', re.IGNORECASE)
 
     def __init__(self, header_name):
         self._header_name = header_name
diff --git a/botocore/serialize.py b/botocore/serialize.py
index 9f8d7601c7..1b1d78b436 100644
--- a/botocore/serialize.py
+++ b/botocore/serialize.py
@@ -64,7 +64,7 @@
 ISO8601 = '%Y-%m-%dT%H:%M:%SZ'
 # Same as ISO8601, but with microsecond precision.
 ISO8601_MICRO = '%Y-%m-%dT%H:%M:%S.%fZ'
-HOST_PREFIX_RE = re.compile(r"^[A-Za-z0-9\.\-]+$")
+HOST_PREFIX_RE = re.compile(r"^[A-Za-z0-9\.\-]+\Z")
 
 TIMESTAMP_PRECISION_DEFAULT = 'default'
 TIMESTAMP_PRECISION_MILLISECOND = 'millisecond'
diff --git a/botocore/utils.py b/botocore/utils.py
index 655c1d706f..d359b0b72c 100644
--- a/botocore/utils.py
+++ b/botocore/utils.py
@@ -1335,7 +1335,9 @@ def validate_region_name(region_name):
     """Provided region_name must be a valid host label."""
     if region_name is None:
         return
-    valid_host_label = re.compile(r'^(?![0-9]+$)(?!-)[a-zA-Z0-9-]{,63}(?<!-)$')
+    valid_host_label = re.compile(
+        r'^(?![0-9]+$)(?!-)[a-zA-Z0-9-]{,63}(?<!-)\Z'
+    )
     valid = valid_host_label.match(region_name)
     if not valid:
         raise InvalidRegionError(region_name=region_name)
@@ -2644,7 +2646,7 @@ def _s3_addressing_handler(self):
 class S3ControlEndpointSetter:
     _DEFAULT_PARTITION = 'aws'
     _DEFAULT_DNS_SUFFIX = 'amazonaws.com'
-    _HOST_LABEL_REGEX = re.compile(r'^[a-zA-Z0-9\-]{1,63}$')
+    _HOST_LABEL_REGEX = re.compile(r'^[a-zA-Z0-9\-]{1,63}\Z')
 
     def __init__(
         self,
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
index 955e04c2d9..a71465b895 100644
--- a/tests/unit/test_utils.py
+++ b/tests/unit/test_utils.py
@@ -2207,6 +2207,19 @@ def test_get_region_validates_region_from_head_bucket(self):
         with self.assertRaises(InvalidRegionError):
             self.redirector.get_bucket_region('foo', response)
 
+    def test_get_region_rejects_region_with_trailing_newline(self):
+        response = (
+            None,
+            {
+                'Error': {'Code': 'PermanentRedirect'},
+                'ResponseMetadata': {
+                    'HTTPHeaders': {'x-amz-bucket-region': 'us-west-2\n'}
+                },
+            },
+        )
+        with self.assertRaises(InvalidRegionError):
+            self.redirector.get_bucket_region('foo', response)
+
 
 class TestArnParser(unittest.TestCase):
     def setUp(self):