Opened 5 years ago

Closed 5 years ago

#31459 closed Cleanup/optimization (fixed)

URL path parameter regex too lenient.

Reported by: Adam Johnson Owned by: Adam Johnson
Component: Core (URLs) Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Mariusz Felisiak)

A ​user on the Django forum tried to configure a URL like books/<int:book.id>/. This was successfully parsed as a URL, but no converters applied.

This is because the left hand side of the regex for finding path parameter syntax looks for converter names with "anything not a colon or >". But the right hand side matches only word characters.

If we matched "anything not a >", then the attempted parameter would have been matched, and "book.id" would have hit the guard we have for invalid identifiers, with a message like:

"URL route 'books/<int:book.id>/' uses parameter name 'book.id' which isn't a valid Python identifier."

Change History (5)

comment:1 by Adam Johnson, 5 years ago

Has patch: set

comment:2 by Mariusz Felisiak, 5 years ago

Description: modified (diff)
Owner: changed from nobody to Adam Johnson
Summary: URL path parameter regex too lenient → URL path parameter regex too lenient.
Triage Stage: Unreviewed → Accepted

​PR

comment:3 by Mariusz Felisiak, 5 years ago

Type: Bug → Cleanup/optimization

comment:4 by Mariusz Felisiak, 5 years ago

Triage Stage: Accepted → Ready for checkin

comment:5 by Mariusz Felisiak <felisiak.mariusz@…>, 5 years ago

Resolution: → fixed
Status: assigned → closed

In 4bb33bb0:

Fixed #31459 -- Fixed handling invalid indentifiers in URL path conversion.

This patch adjusted existing tests that used invalid identifiers.

Note: See TracTickets for help on using tickets.
Back to Top