search

pypa / packaging.python.org

Python Packaging User Guide
http://packaging.python.org
1.45k stars 932 forks source link

Official version-parsing regular expression allows leading zero(es) #1598

Closed larryhastings closed 2 months ago

larryhastings commented 2 months ago

The current official version-parsing regular expression in the "version-specifiers" document:

https://github.com/pypa/packaging.python.org/blob/main/source/specifications/version-specifiers.rst

uses [0-9]+ in a bunch of places to match against segments specifying numbers. I suggest this is a little sloppy, in that it matches against the string "000123", and indeed "000000000". I regard those as malformed.

I don't know if this regular expression needs to be super permissive, for backwards-compatibility reasons or whatnot. If this regular expression is meant to be rigorous in what it accepts, I'd suggest switching to something like 0|(?:[1-9][0-9]*) instead.

larryhastings commented 2 months ago

Oh, this is handled in the version_specifiers document by saying effectively "ignore leading zeroes". Nevermind!