fix: reject trailing newline in tool-name and URI-template varname validation (#3076)
Python's $ with re.match also matches just before a single trailing newline, so tool-name validation accepted "name\n" and UriTemplate.parse accepted varnames like "foo\n". Switch both checks to re.fullmatch. Closes #3084
This commit is contained in:
parent
4fc8882c02
commit
1216c53693
2 changed files with 9 additions and 2 deletions
|
|
@ -65,12 +65,17 @@ def test_validate_tool_name_rejects_name_exceeding_max_length() -> None:
|
|||
("get,user,profile", "','"),
|
||||
("user/profile/update", "'/'"),
|
||||
("user@domain.com", "'@'"),
|
||||
# a single trailing newline slipped past `$` with re.match
|
||||
("valid_name\n", "'\\n'"),
|
||||
("a" * 127 + "\n", "'\\n'"),
|
||||
],
|
||||
ids=[
|
||||
"with_spaces",
|
||||
"with_commas",
|
||||
"with_slashes",
|
||||
"with_at_symbol",
|
||||
"with_trailing_newline",
|
||||
"max_length_with_trailing_newline",
|
||||
],
|
||||
)
|
||||
def test_validate_tool_name_rejects_invalid_characters(tool_name: str, expected_char: str) -> None:
|
||||
|
|
|
|||
|
|
@ -144,6 +144,8 @@ def test_parse_rejects_operator_without_variable():
|
|||
# RFC §2.3: dots only between varchars, not consecutive or trailing
|
||||
"foo..bar",
|
||||
"foo.",
|
||||
# a single trailing newline slipped past `$` with re.match
|
||||
"foo\n",
|
||||
],
|
||||
)
|
||||
def test_parse_rejects_invalid_varname(name: str):
|
||||
|
|
|
|||
Loading…
Reference in a new issue