Repository navigation
Reject 0x, signs, underscores and stray hyphens in uuid() - #560
Open
emincan2000 wants to merge 1 commit into
Open
emincan2000 wants to merge 1 commit into
emincan2000 wants to merge 1 commit into
Conversation
UUID() drops every hyphen wherever it is and parses the rest with int(), so strings like "0x" plus 30 hex digits or a UUID with a moved hyphen were accepted. The regex fallback meant to catch this never ran because a UUID object is always truthy. Match the forms UUID() documents directly instead.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
uuid() passes the string to UUID(), so the regex that follows never runs because a UUID object is always truthy. UUID() removes every hyphen regardless of its position and parses what remains with int(value, 16). This lets some strings pass that aren't UUIDs. For example 0xc1c94f0deb43e992a14775189ec9f8 (0x plus 30 hex digits) returns True. The signed string +bc1c94f0deb43e992a14775189ec9f8 also passes. So does 2bc1c94f_deb43e992a14775189ec9f8 with an underscore. Even 30 hex digits with a space on each side are accepted. Moving a hyphen into the next group also works, as in 2bc1c94f-0deb4-3e9-92a1-4775189ec9f8.
This replaces the unreachable fallback with a single regex that accepts the forms documented by UUID(). The hyphenated form and 32 plain hex digits still pass with or without braces. The urn:uuid: prefix is also still accepted because #480 said those forms should stay. Hyphens must appear in their usual positions or be absent entirely. Non-string input like 123 now gives a ValidationError instead of raising AttributeError.
I compared this with plain UUID() on 400k mutated strings. Nothing previously rejected is accepted now. Every newly rejected string has a misplaced hyphen or a non-hex character or an unpaired brace. The full test suite and the doctests pass. The new invalid cases fail on main.
This also rejects non-ASCII digits in uuid(), so it overlaps with the uuid part of #508.