MacAddress.validate_mac_address parsed each octet with int(part, 16),
which also accepts a leading +/- sign and surrounding whitespace. As a
result strings like -a:-b:-c:-d:-e:-f, +a:+b:+c:+d:+e:+f and
" a: b: c: d: e: f" were accepted, with the sign/whitespace variants
silently normalized into a valid-looking MAC the caller never supplied.
Require both characters of each octet to be hex digits before the int()
conversion so malformed octets raise the mac_address_format error like
other invalid input.
dualfroz
upstream