Skip to content

fix: reject invalid interpreter tags - #1351

Merged
henryiii merged 2 commits into
pypa:mainfrom
deepakganesh78:fix-invalid-interpreter-tags
Jul 28, 2026
Merged

fix: reject invalid interpreter tags#1351
henryiii merged 2 commits into
pypa:mainfrom
deepakganesh78:fix-invalid-interpreter-tags

Conversation

@deepakganesh78

@deepakganesh78 deepakganesh78 commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Fixes #577.

Summary

  • validate every compressed interpreter-tag member as an identifier before constructing Tag objects
  • reject malformed wheel names such as playlyfe-0.1.1-2.7.6-none-any.whl, which previously expanded into the numeric interpreter tags 2, 7, and 6
  • preserve support for custom implementation identifiers and wrap parser failures as InvalidWheelFilename
  • update the API documentation and changelog

Compatibility

The validation uses str.isidentifier() rather than a fixed implementation allowlist. Existing well-known tags, custom implementation identifiers, uppercase input normalized by Tag, and every tag produced by sys_tags() continue to parse. Non-empty ABI and platform components retain their existing behavior.

Tests

  • python -m pytest tests/test_tags.py::TestParseTag tests/test_utils.py -q — 105 passed
  • python -m pytest -q — 62,399 passed, 1 skipped, 427 deselected
  • targeted ruff-check, ruff-format, and reStructuredText pre-commit hooks — passed
  • python -m nox -s docs — HTML, LaTeX, and doctest builds passed; 418 doctests passed
  • compatibility probe over all 45 local sys_tags() entries plus custom interpreter identifiers — passed
  • validation-boundary probe confirming non-empty ABI/platform components remain accepted — passed

nox -s lint also passed all hooks except the repository's pinned mypy hook on Windows: mypy 2.1 rejects the configured Python 3.9 target and reports the existing os.confstr platform error in _manylinux.py.

deepakganesh78 and others added 2 commits July 25, 2026 16:20
Validate interpreter components as identifiers so malformed wheel filenames such as 2.7.6 no longer expand into numeric tags.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Describe the exact validation boundary: interpreter components must be identifiers, while other non-empty tag components remain accepted.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@henryiii henryiii left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PEP said it was an identifier, so I think this is a valid restriction, and will protect against some mistakes.

@henryiii
henryiii merged commit 26fa1d4 into pypa:main Jul 28, 2026
69 checks passed
@henryiii henryiii changed the title Reject invalid interpreter tags fix: reject invalid interpreter tags Jul 28, 2026
@henryiii

Copy link
Copy Markdown
Contributor

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

migrating from distlib.wheel: packaging.utils.parse_wheel_filename allows illegal platform tags

2 participants