Apply stricter validation to all wheel filename segments

crates/uv-distribution-filename/src/build_tag.rs

@@ -9,6 +9,8 @@ pub enum BuildTagError {
     Empty,
     #[error("must start with a digit")]
     NoLeadingDigit,
+    #[error("must contain only ASCII letters, digits, underscores, and periods")]
+    InvalidCharacters,
     #[error(transparent)]
     ParseInt(#[from] ParseIntError),
 }
@@ -45,8 +47,18 @@ impl FromStr for BuildTag {
             return Err(BuildTagError::Empty);
         }
 
+        let mut prefix_end = None;
+        for (index, byte) in s.bytes().enumerate() {
+            if !is_build_tag_byte(byte) {
+                return Err(BuildTagError::InvalidCharacters);
+            }
+            if prefix_end.is_none() && !byte.is_ascii_digit() {
+                prefix_end = Some(index);
+            }
+        }
+
         // A build tag must start with a digit.
-        let (prefix, suffix) = match s.find(|c: char| !c.is_ascii_digit()) {
+        let (prefix, suffix) = match prefix_end {
             // Ex) `abc`
             Some(0) => return Err(BuildTagError::NoLeadingDigit),
             // Ex) `123abc`
@@ -70,3 +82,45 @@ impl std::fmt::Display for BuildTag {
         }
     }
 }
+
+fn is_build_tag_byte(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'.')
+}
+
+#[cfg(test)]
+mod tests {
+    use std::str::FromStr;
+
+    use super::BuildTag;
+
+    #[test]
+    fn parse_periods() {
+        assert_eq!(
+            BuildTag::from_str("0.editable")
+                .map(|build_tag| build_tag.to_string())
+                .map_err(|err| err.to_string()),
+            Ok("0.editable".to_string())
+        );
+    }
+
+    #[test]
+    fn err_invalid_characters() {
+        let err = BuildTag::from_str("1/../../target").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = BuildTag::from_str(r"1..\..\target").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = BuildTag::from_str("1target:stream").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = BuildTag::from_str("1-target").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = BuildTag::from_str("1 target").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = BuildTag::from_str("1target\u{e9}").unwrap_err();
+        insta::assert_snapshot!(err, @"must contain only ASCII letters, digits, underscores, and periods");
+    }
+}

crates/uv-distribution-filename/src/wheel.rs

@@ -15,7 +15,7 @@ use uv_platform_tags::{
 };
 
 use crate::splitter::MemchrSplitter;
-use crate::wheel_tag::{WheelTag, WheelTagLarge, WheelTagSmall};
+use crate::wheel_tag::{TagSet, WheelTag, WheelTagLarge, WheelTagSmall};
 use crate::{BuildTag, BuildTagError};
 
 #[derive(
@@ -262,18 +262,9 @@ impl WheelFilename {
             WheelTag::Large {
                 large: Box::new(WheelTagLarge {
                     build_tag,
-                    python_tag: MemchrSplitter::split(python_tag, b'.')
-                        .map(LanguageTag::from_str)
-                        .filter_map(Result::ok)
-                        .collect(),
-                    abi_tag: MemchrSplitter::split(abi_tag, b'.')
-                        .map(AbiTag::from_str)
-                        .filter_map(Result::ok)
-                        .collect(),
-                    platform_tag: MemchrSplitter::split(platform_tag, b'.')
-                        .map(PlatformTag::from_str)
-                        .filter_map(Result::ok)
-                        .collect(),
+                    python_tag: parse_large_tag_component::<LanguageTag>(python_tag, filename)?,
+                    abi_tag: parse_large_tag_component::<AbiTag>(abi_tag, filename)?,
+                    platform_tag: parse_large_tag_component::<PlatformTag>(platform_tag, filename)?,
                     repr: repr.into(),
                 }),
             }
@@ -287,6 +278,39 @@ impl WheelFilename {
     }
 }
 
+fn parse_large_tag_component<T: FromStr>(
+    component: &str,
+    filename: &str,
+) -> Result<TagSet<T>, WheelFilenameError> {
+    if component.is_empty() {
+        return Err(invalid_tag_component(filename));
+    }
+
+    let mut tags = TagSet::new();
+    for tag in MemchrSplitter::split(component, b'.') {
+        if tag.is_empty() || !tag.bytes().all(is_tag_atom_byte) {
+            return Err(invalid_tag_component(filename));
+        }
+        if let Ok(tag) = T::from_str(tag) {
+            tags.push(tag);
+        }
+    }
+
+    Ok(tags)
+}
+
+fn invalid_tag_component(filename: &str) -> WheelFilenameError {
+    WheelFilenameError::InvalidWheelFileName(
+        filename.to_string(),
+        "Tag components must contain only ASCII letters, digits, underscores, and periods"
+            .to_string(),
+    )
+}
+
+fn is_tag_atom_byte(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || byte == b'_'
+}
+
 impl<'de> Deserialize<'de> for WheelFilename {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
     where
@@ -408,6 +432,33 @@ mod tests {
     fn err_invalid_build_tag() {
         let err = WheelFilename::from_str("foo-1.2.3-tag-py3-none-any.whl").unwrap_err();
         insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-tag-py3-none-any.whl" has an invalid build tag: must start with a digit"#);
+
+        let err = WheelFilename::from_str("foo-1.2.3-1/../../target-py3-none-any.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-1/../../target-py3-none-any.whl" has an invalid build tag: must contain only ASCII letters, digits, underscores, and periods"#);
+    }
+
+    #[test]
+    fn err_invalid_tag_component() {
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-../target.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-../target.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
+
+        let err = WheelFilename::from_str(r"foo-1.2.3-py3-none-..\target.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-..\target.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
+
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-target:stream.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-target:stream.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
+
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-freebsd_13_x86/64.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-freebsd_13_x86/64.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
+
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-unknown tag.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-unknown tag.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
+
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-unknown\u{e9}.whl").unwrap_err();
+        insta::assert_snapshot!(err, @"The wheel filename \"foo-1.2.3-py3-none-unknown\u{e9}.whl\" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods");
+
+        let err = WheelFilename::from_str("foo-1.2.3-py3-none-unknown..tag.whl").unwrap_err();
+        insta::assert_snapshot!(err, @r#"The wheel filename "foo-1.2.3-py3-none-unknown..tag.whl" is invalid: Tag components must contain only ASCII letters, digits, underscores, and periods"#);
     }
 
     #[test]

crates/uv-platform-tags/src/lib.rs

@@ -1,7 +1,7 @@
 pub use abi_tag::{AbiTag, CPythonAbiVariants, ParseAbiTagError};
 pub use language_tag::{LanguageTag, ParseLanguageTagError};
 pub use platform::{Arch, Os, Platform, PlatformError};
-pub use platform_tag::{ParsePlatformTagError, PlatformTag};
+pub use platform_tag::{ParsePlatformTagError, ParseReleaseArchError, PlatformTag, ReleaseArch};
 pub use tags::{
     BinaryFormat, IncompatibleTag, TagCompatibility, TagPriority, Tags, TagsError, TagsOptions,
 };

crates/uv-platform-tags/src/platform.rs

@@ -5,12 +5,20 @@ use std::{fmt, io};
 
 use thiserror::Error;
 
+use crate::ParseReleaseArchError;
+
 #[derive(Error, Debug)]
 pub enum PlatformError {
     #[error(transparent)]
     IOError(#[from] io::Error),
     #[error("Failed to detect the operating system version: {0}")]
     OsVersionDetectionError(String),
+    #[error("Invalid platform release and architecture `{release_arch}`: {error}")]
+    InvalidReleaseArch {
+        release_arch: String,
+        #[source]
+        error: ParseReleaseArchError,
+    },
     #[error("Invalid Android architecture: {0}")]
     InvalidAndroidArch(Arch),
     #[error("Invalid iOS simulator architecture: {0}")]