Repository navigation
Reject raw ASCII control characters in URLs - #518
Open
Apeksha9389 wants to merge 1 commit into
Open
Apeksha9389 wants to merge 1 commit into
Apeksha9389 wants to merge 1 commit into
Conversation
Author
|
Could a maintainer approve the pending CI runs and review this PR for merging? Local tests, doctests, Ruff, and strict Pyright all pass. Thank you. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
URLs containing raw NUL or DEL characters currently validate successfully, for example
url("https://example.com/?q=\x00"). Leading controls can also be discarded byurlsplitbefore validation sees them. Reject raw ASCII controls before parsing, alongside the existing whitespace rejection. Percent-encoded control bytes remain valid URL data.This follows the RFC 3986 character grammar. The related open #514 changes
uri(), while this PR covers the separateurl()entry point and its parsing path.The added tests cover all 33 ASCII control characters in five URL positions and ten percent-encoded positive controls. Seventy of these regressions fail on master. Full tests including doctests pass on Python 3.12 (1,346 passed). Ruff lint/format and strict Pyright pass with zero diagnostics. Other Python versions are left to CI.
Prepared with AI assistance; reproduced and tested locally.