fix: add file handling to URL fields

Requires a modicum of special handling due to hostnames being
optional.

Fixes: Issue #2249

AUTHORS.rst

@@ -176,3 +176,4 @@ Contributors (chronological)
 - Peter C `@somethingnew2-0 <https://github.com/somethingnew2-0>`_
 - Marcel Jackwerth `@mrcljx` <https://github.com/mrcljx>`_
 - Fares Abubaker `@Fares-Abubaker <https://github.com/Fares-Abubaker>`_
+- Nicolas Simonds `@0xDEC0DE <https://github.com/0xDEC0DE>`_

CHANGELOG.rst

@@ -17,6 +17,7 @@ Bug fixes:
 - Correctly handle multiple `@post_load <marshmallow.post_load>` methods where one method appends to
   the data and another passes ``pass_original=True`` (:issue:`1755`).
   Thanks :user:`ghostwheel42` for reporting.
+- ``URL`` fields now properly validate ``file`` paths.
 
 Documentation:
 
@@ -25,8 +26,8 @@ Documentation:
 
 Deprecations:
 
-- The ``ordered`` `class Meta <marshmallow.Schema.Meta>` option is deprecated (:issue:`2146`, :pr:`2762`). 
-  Field order is already preserved by default. Set `marshmallow.Schema.dict_class` to `collections.OrderedDict` 
+- The ``ordered`` `class Meta <marshmallow.Schema.Meta>` option is deprecated (:issue:`2146`, :pr:`2762`).
+  Field order is already preserved by default. Set `marshmallow.Schema.dict_class` to `collections.OrderedDict`
   to maintain the previous behavior.
 
 3.25.1 (2025-01-11)

src/marshmallow/validate.py

@@ -216,6 +216,7 @@ def __call__(self, value: str) -> str:
             raise ValidationError(message)
 
         # Check first if the scheme is valid
+        scheme = None
         if "://" in value:
             scheme = value.split("://")[0].lower()
             if scheme not in self.schemes:
@@ -225,7 +226,15 @@ def __call__(self, value: str) -> str:
             relative=self.relative, absolute=self.absolute, require_tld=self.require_tld
         )
 
-        if not regex.search(value):
+        # The `file` scheme is a slightly-special case: hostnames are optional,
+        # and if absent it means `localhost`; fill it in for the validation if
+        # needed
+        if scheme == "file" and value.startswith("file:///"):
+            matched = regex.search(value.replace("file:///", "file://localhost/", 1))
+        else:
+            matched = regex.search(value)
+
+        if not matched:
             raise ValidationError(message)
 
         return value

tests/test_validate.py

@@ -205,6 +205,13 @@ def test_url_custom_scheme():
     assert validator(url) == url
 
 
+def test_url_file_scheme():
+    # Ensure that file URLs don't get confused
+    url = "file:///tmp/tmp1234"
+    validator = validate.URL(schemes={"file"})
+    assert validator(url) == url
+
+
 def test_url_relative_and_custom_schemes():
     validator = validate.URL(relative=True)
     # By default, ws not allowed