fix(etag): reject codepoints above 0xFF in ETag.parse#77
Open
koteshyelamati wants to merge 2 commits into
Open
fix(etag): reject codepoints above 0xFF in ETag.parse#77koteshyelamati wants to merge 2 commits into
koteshyelamati wants to merge 2 commits into
Conversation
Add test for parsing invalid entity-tag characters above obs-text.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the missing upper-bound check to
ETag.parse's character-set guard so codepoints above0xFFare rejected, matching RFC 7232 §2.3 (etagc = %x21 / %x23-7E / obs-text,obs-text = %x80-FF) and the inline comment that already documents this boundary. Without the bound, any Pythonstrcodepoint at or above0x80was accepted, including codepoints above0xFF(e.g.€) that fall outsideobs-textand are not valid entity-tag characters. The accepted value then round-trips throughETag.__str__, whichrequest_conditions._format_etagsuses when buildingIf-Match/If-None-Matchheaders, so a non-conformant tag could flow onto the wire instead of being caught at parse time.Also adds
test_parse_above_obs_text_raises, pinning rejection of a codepoint above0xFFalongside the existing control-char and space cases intests/http/test_etag.py.Fixes #19
Checklist
uv run pytest -qpassesuv run mypy --strictpassesuv run ruff checkanduv run ruff format --checkpass__all__.pyfiles carry the two-line MIT licence headerfeat:/fix:/chore:/docs:/ci:prefixesNotes:
pytest/mypy/ruffmyself, so I've left those unchecked for CI to confirm. The fix matches the exact change suggested in the issue.test:prefix, which isn't in the list above (feat/fix/chore/docs/ci). Happy to squash into a singlefix:commit if you'd prefer.