Validate RGB hex string length before conversion

src/pptx/dml/color.py

@@ -101,8 +101,7 @@ def _validate_brightness_value(self, value):
             raise ValueError("brightness must be number in range -1.0 to 1.0")
         if isinstance(self._color, _NoneColor):
             msg = (
-                "can't set brightness when color.type is None. Set color.rgb"
-                " or .theme_color first."
+                "can't set brightness when color.type is None. Set color.rgb or .theme_color first."
             )
             raise ValueError(msg)
 
@@ -291,10 +290,12 @@ def __str__(self):
         return "%02X%02X%02X" % self
 
     @classmethod
-    def from_string(cls, rgb_hex_str):
+    def from_string(cls, rgb_hex_str: str) -> RGBColor:
         """
-        Return a new instance from an RGB color hex string like ``'3C2F80'``.
+        Return a new instance from a six-character RGB hex string like ``'3C2F80'``.
         """
+        if len(rgb_hex_str) != 6:
+            raise ValueError("RGB string must be six characters long, got '%s'" % rgb_hex_str)
         r = int(rgb_hex_str[:2], 16)
         g = int(rgb_hex_str[2:4], 16)
         b = int(rgb_hex_str[4:], 16)

tests/dml/test_color.py

@@ -272,9 +272,15 @@ def it_is_natively_constructed_using_three_ints_0_to_255(self):
         with pytest.raises(ValueError):
             RGBColor(12, 256, 56)
 
-    def it_can_construct_from_a_hex_string_rgb_value(self):
-        rgb = RGBColor.from_string("123456")
-        assert rgb == RGBColor(0x12, 0x34, 0x56)
+    @pytest.mark.parametrize("value", ["ABCDEF", "abcdef"])
+    def it_can_construct_from_a_hex_string_rgb_value(self, value: str):
+        rgb = RGBColor.from_string(value)
+        assert rgb == RGBColor(0xAB, 0xCD, 0xEF)
+
+    @pytest.mark.parametrize("value", ["12345", "0000000", "00000000"])
+    def it_rejects_rgb_hex_strings_with_an_incorrect_length(self, value: str):
+        with pytest.raises(ValueError, match="must be six characters long"):
+            RGBColor.from_string(value)
 
     def it_can_provide_a_hex_string_rgb_value(self):
         assert str(RGBColor(0x12, 0x34, 0x56)) == "123456"