Skip to content

fix(etag): reject codepoints above 0xFF in ETag.parse#77

Open
koteshyelamati wants to merge 2 commits into
dexpace:mainfrom
koteshyelamati:fix-etag-upper-bound
Open

fix(etag): reject codepoints above 0xFF in ETag.parse#77
koteshyelamati wants to merge 2 commits into
dexpace:mainfrom
koteshyelamati:fix-etag-upper-bound

Conversation

@koteshyelamati

Copy link
Copy Markdown

What

Adds the missing upper-bound check to ETag.parse's character-set guard so codepoints above 0xFF are rejected, matching RFC 7232 §2.3 (etagc = %x21 / %x23-7E / obs-text, obs-text = %x80-FF) and the inline comment that already documents this boundary. Without the bound, any Python str codepoint at or above 0x80 was accepted, including codepoints above 0xFF (e.g. ) that fall outside obs-text and are not valid entity-tag characters. The accepted value then round-trips through ETag.__str__, which request_conditions._format_etags uses when building If-Match / If-None-Match headers, so a non-conformant tag could flow onto the wire instead of being caught at parse time.

Also adds test_parse_above_obs_text_raises, pinning rejection of a codepoint above 0xFF alongside the existing control-char and space cases in tests/http/test_etag.py.

Fixes #19

Checklist

  • uv run pytest -q passes
  • uv run mypy --strict passes
  • uv run ruff check and uv run ruff format --check pass
  • New/changed public symbols have Google-style docstrings and appear in __all__
  • New .py files carry the two-line MIT licence header
  • Commit messages use the feat: / fix: / chore: / docs: / ci: prefixes

Notes:

  • This is a one-line logic fix plus a one-line test addition; no new public symbols or new files, so the docstring/licence-header items don't apply.
  • I edited via GitHub's web UI and didn't have a local checkout to run pytest/mypy/ruff myself, so I've left those unchecked for CI to confirm. The fix matches the exact change suggested in the issue.
  • The second commit uses a test: prefix, which isn't in the list above (feat/fix/chore/docs/ci). Happy to squash into a single fix: commit if you'd prefer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ETag.parse accepts characters above the obs-text range (U+0100 and up)

1 participant