[project @ Reject URIs with illegal characters in urinorm]

http://j3h.us/ · http://j3h.us/ · commit 6075706658e2 · 2008-06-10T23:42:22.000Z
diff --git a/openid/test/urinorm.txt b/openid/test/urinorm.txt
@@ -76,4 +76,12 @@ fail
 
 Non-absolute URI
 http:/foo
-fail
+fail
+
+Illegal character in URI
+http://<illegal>.com/
+fail
+
+Non-ascii character in URI
+http://foo.com/
+fail
diff --git a/openid/urinorm.py b/openid/urinorm.py
@@ -4,6 +4,15 @@
 uri_pattern = r'^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?'
 uri_re = re.compile(uri_pattern)
 
+# gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"
+#
+# sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"
+#                  / "*" / "+" / "," / ";" / "="
+#
+# unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"
+
+uri_illegal_char_re = re.compile(
+    "[^-A-Za-z0-9:/?#[\]@!$&'()*+,;=._~%]", re.UNICODE)
 
 authority_pattern = r'^([^@]*@)?([^:]*)(:.*)?'
 authority_re = re.compile(authority_pattern)
@@ -131,6 +140,11 @@ def urinorm(uri):
     if isinstance(uri, unicode):
         uri = _escapeme_re.sub(_pct_escape_unicode, uri).encode('ascii')
 
+    illegal_mo = uri_illegal_char_re.search(uri)
+    if illegal_mo:
+        raise ValueError('Illegal characters in URI: %r at position %s' %
+                         (illegal_mo.group(), illegal_mo.start()))
+
     uri_mo = uri_re.match(uri)
 
     scheme = uri_mo.group(2)
