Skip to content

is_valid_scheme is missing an end anchor, so invalid schemes are accepted and URLs mis-parsed #192

Description

@pramodavansaber

Summary

is_valid_scheme matches the scheme regex with re.match, but the pattern lacks a trailing $ anchor — unlike the module's other validators, which use ^...$. Any string whose prefix looks like a scheme is therefore accepted, so a URL like a b:c is mis-parsed as scheme a b + path c, instead of no scheme and path a b:c.

Reproduction

from furl import furl
f = furl('a b:c')
print(f.scheme)      # 'a b'   <- expected None
print(str(f.path))   # 'c'     <- expected 'a b:c'

Expected

a b is not a valid scheme (it contains a space), so f.scheme is None and the whole string is the path.

Actual

Scheme 'a b' is extracted and stored; the parse is corrupted.

Fix sketch

Anchor the scheme regex with $ (or use re.fullmatch), matching the module's other validators.

Environment

furl 2.1.4 (master @ 46d9ea7), Python 3.12.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions