Skip to content

Avoid panics for invalid UTF-8 URL credentials#19800

Merged
zanieb merged 1 commit into
astral-sh:mainfrom
zaniebot:zb/fix-invalid-url-credentials
Jun 11, 2026
Merged

Avoid panics for invalid UTF-8 URL credentials#19800
zanieb merged 1 commit into
astral-sh:mainfrom
zaniebot:zb/fix-invalid-url-credentials

Conversation

@zaniebot

@zaniebot zaniebot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Summary

URL credentials are percent-decoded before they are used for HTTP authentication. URLs can contain percent-encoded bytes that are not valid UTF-8, so credentials such as %FF previously triggered an expect panic.

This PR decodes invalid UTF-8 lossily, matching other URL-decoding paths, and adds regression coverage for both usernames and passwords.

Test plan

  • cargo test -p uv-auth --lib from_url_

@zanieb
Avoid panics for invalid UTF-8 URL credentials
d456b52 
## Summary

URL credentials are percent-decoded before they are used for HTTP authentication. URLs can contain percent-encoded bytes that are not valid UTF-8, so credentials such as `%FF` previously triggered an `expect` panic.

Decode invalid UTF-8 lossily instead, matching other URL decoding paths, and add regression coverage for both usernames and passwords.
@zanieb
zanieb enabled auto-merge (squash) June 11, 2026 16:12
@zanieb
zanieb merged commit d3e3772 into astral-sh:main Jun 11, 2026
55 checks passed
@zanieb zanieb added the bug Something isn't working label Jun 11, 2026
@BrewTestBot BrewTestBot mentioned this pull request Jun 11, 2026
Merged
konstin
konstin reviewed Jun 11, 2026
View reviewed changes
Comment thread crates/uv-auth/src/credentials.rs
percent_encoding::percent_decode_str(password)
.decode_utf8()
.expect("An encoded password should always decode")
.decode_utf8_lossy()

@konstin konstin Jun 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like it should raise an error, � usually isn't accepted if another character was expected.

@zanieb zanieb Jun 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was a little wary on this one but bought its claim that a panic was not appropriate. I'll look again.

This was referenced Jun 11, 2026
Closed
Merged
zanieb added a commit that referenced this pull request Jun 11, 2026
@zaniebot @zanieb
Reject invalid UTF-8 URL credentials (#19814)
1a1a801 
## Summary

- make URL credential extraction fallible
- reject percent-decoded usernames and passwords that are not valid
UTF-8
- propagate credential decoding errors through index, Git, project,
publish, and HTTP client paths
- identify failing indexes with their display-safe URL
- add unit and end-to-end regression coverage

## Why

Lossy decoding replaced malformed bytes with U+FFFD, silently changing
the credential sent on the wire and collapsing distinct inputs. URL
parsing remains permissive; the error is raised only when converting URL
userinfo into uv's string credential model.

Follow-up to
#19800 (comment).

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
blake-hamm added a commit to blake-hamm/bhamm-lab that referenced this pull request Jun 12, 2026
@blake-hamm Renovate Bot
chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.21 (#194)
336e42b 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | stage | patch | `0.11.20` → `0.11.21` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/155) for more information.

---

### Release Notes

<details>
<summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary>

### [`v0.11.21`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01121)

[Compare Source](astral-sh/uv@0.11.20...0.11.21)

Released on 2026-06-11.

##### Python

- Add CPython 3.13.14 and 3.14.6 ([#&#8203;19787](astral-sh/uv#19787))

##### Preview features

- Add `environment.root` to `uv workspace metadata --sync` ([#&#8203;19760](astral-sh/uv#19760))
- Allow `uv upgrade` to update a single dependency constraint ([#&#8203;19738](astral-sh/uv#19738))
- Compute and pass `uv workspace metadata` payload in `ty check` ([#&#8203;19763](astral-sh/uv#19763))
- Make packaged applications the default for `uv init` ([#&#8203;17841](astral-sh/uv#17841))

##### Performance

- Add parallel discovery of Python versions for `uv python list` ([#&#8203;18684](astral-sh/uv#18684))
- Avoid normalizing source distribution names twice ([#&#8203;19784](astral-sh/uv#19784))

##### Bug fixes

- Improve cache robustness and pruning behavior
  - Allow CI cache pruning without an sdist bucket ([#&#8203;19802](astral-sh/uv#19802))
  - Avoid overflow when reading malformed cache entries ([#&#8203;19799](astral-sh/uv#19799))
  - Preserve cached Python downloads during cache pruning ([#&#8203;19795](astral-sh/uv#19795))
  - Reject running inside the cache ([#&#8203;19659](astral-sh/uv#19659))
- Fix Python discovery and version request edge cases
  - Avoid panics for Unicode Python version requests ([#&#8203;19797](astral-sh/uv#19797))
  - Fix handling of non-critical errors in `uv python list` with path requests ([#&#8203;19774](astral-sh/uv#19774))
  - Fix stop-discovery-at regression ([#&#8203;19769](astral-sh/uv#19769))
- Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  - Allow trailing commas in version specifiers ([#&#8203;19806](astral-sh/uv#19806))
  - Avoid panics for invalid UTF-8 URL credentials ([#&#8203;19800](astral-sh/uv#19800))
  - Avoid panics for malformed source distribution filenames ([#&#8203;19776](astral-sh/uv#19776))
  - Avoid panics for trailing extra separators ([#&#8203;19779](astral-sh/uv#19779))
  - Avoid stack overflow for recursive requirements path aliases ([#&#8203;19777](astral-sh/uv#19777))
  - Ignore reversed string compatible-release markers ([#&#8203;19782](astral-sh/uv#19782))
  - Reject duplicate entries in conflict sets ([#&#8203;19801](astral-sh/uv#19801))
  - Reject malformed hash options in requirements files ([#&#8203;19783](astral-sh/uv#19783))
  - Reject source distribution filenames without a separator ([#&#8203;19803](astral-sh/uv#19803))
  - Use UTF-8 lengths for requirement errors ([#&#8203;19781](astral-sh/uv#19781))
  - Use UTF-8 lengths for trailing marker errors ([#&#8203;19796](astral-sh/uv#19796))
  - Use byte offsets when peeking over requirements ([#&#8203;19780](astral-sh/uv#19780))
  - Validate GraalPy ABI suffixes ([#&#8203;19805](astral-sh/uv#19805))
- Improve wheel entry-point error handling and virtual environment activation quoting
  - Propagate errors when reading wheel entry points ([#&#8203;19794](astral-sh/uv#19794))
  - Quote virtual environment activation paths with shell metacharacters ([#&#8203;19798](astral-sh/uv#19798))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: Renovate Bot <renovate@bhamm-lab.com>
Reviewed-on: https://codeberg.org/blake-hamm/bhamm-lab/pulls/194
hbjydev pushed a commit to hbjydev/phoebe that referenced this pull request Jun 14, 2026
hayden-bot forgejo.hayden.moe Instance
fix(github-release): update release uv (0.11.19 → 0.11.21) (#92)
ab9e27d 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [uv](https://github.com/astral-sh/uv) | patch | `0.11.19` → `0.11.21` |

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.11.21`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01121)

[Compare Source](astral-sh/uv@0.11.20...0.11.21)

Released on 2026-06-11.

##### Python

- Add CPython 3.13.14 and 3.14.6 ([#&#8203;19787](astral-sh/uv#19787))

##### Preview features

- Add `environment.root` to `uv workspace metadata --sync` ([#&#8203;19760](astral-sh/uv#19760))
- Allow `uv upgrade` to update a single dependency constraint ([#&#8203;19738](astral-sh/uv#19738))
- Compute and pass `uv workspace metadata` payload in `ty check` ([#&#8203;19763](astral-sh/uv#19763))
- Make packaged applications the default for `uv init` ([#&#8203;17841](astral-sh/uv#17841))

##### Performance

- Add parallel discovery of Python versions for `uv python list` ([#&#8203;18684](astral-sh/uv#18684))
- Avoid normalizing source distribution names twice ([#&#8203;19784](astral-sh/uv#19784))

##### Bug fixes

- Improve cache robustness and pruning behavior
  - Allow CI cache pruning without an sdist bucket ([#&#8203;19802](astral-sh/uv#19802))
  - Avoid overflow when reading malformed cache entries ([#&#8203;19799](astral-sh/uv#19799))
  - Preserve cached Python downloads during cache pruning ([#&#8203;19795](astral-sh/uv#19795))
  - Reject running inside the cache ([#&#8203;19659](astral-sh/uv#19659))
- Fix Python discovery and version request edge cases
  - Avoid panics for Unicode Python version requests ([#&#8203;19797](astral-sh/uv#19797))
  - Fix handling of non-critical errors in `uv python list` with path requests ([#&#8203;19774](astral-sh/uv#19774))
  - Fix stop-discovery-at regression ([#&#8203;19769](astral-sh/uv#19769))
- Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
  - Allow trailing commas in version specifiers ([#&#8203;19806](astral-sh/uv#19806))
  - Avoid panics for invalid UTF-8 URL credentials ([#&#8203;19800](astral-sh/uv#19800))
  - Avoid panics for malformed source distribution filenames ([#&#8203;19776](astral-sh/uv#19776))
  - Avoid panics for trailing extra separators ([#&#8203;19779](astral-sh/uv#19779))
  - Avoid stack overflow for recursive requirements path aliases ([#&#8203;19777](astral-sh/uv#19777))
  - Ignore reversed string compatible-release markers ([#&#8203;19782](astral-sh/uv#19782))
  - Reject duplicate entries in conflict sets ([#&#8203;19801](astral-sh/uv#19801))
  - Reject malformed hash options in requirements files ([#&#8203;19783](astral-sh/uv#19783))
  - Reject source distribution filenames without a separator ([#&#8203;19803](astral-sh/uv#19803))
  - Use UTF-8 lengths for requirement errors ([#&#8203;19781](astral-sh/uv#19781))
  - Use UTF-8 lengths for trailing marker errors ([#&#8203;19796](astral-sh/uv#19796))
  - Use byte offsets when peeking over requirements ([#&#8203;19780](astral-sh/uv#19780))
  - Validate GraalPy ABI suffixes ([#&#8203;19805](astral-sh/uv#19805))
- Improve wheel entry-point error handling and virtual environment activation quoting
  - Propagate errors when reading wheel entry points ([#&#8203;19794](astral-sh/uv#19794))
  - Quote virtual environment activation paths with shell metacharacters ([#&#8203;19798](astral-sh/uv#19798))

### [`v0.11.20`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01120)

[Compare Source](astral-sh/uv@0.11.19...0.11.20)

Released on 2026-06-10.

##### Enhancements

- Add `--emit-index-url` and `--emit-find-links` to `uv export` ([#&#8203;18370](astral-sh/uv#18370))
- Add `--find-links` support for `uv pip list` ([#&#8203;16103](astral-sh/uv#16103))
- Group executable install errors during `uv python install` ([#&#8203;19691](astral-sh/uv#19691))
- Use ICF in macOS release builds to reduce binary sizes ([#&#8203;19615](astral-sh/uv#19615))

##### Preview features

- Add initial hidden `uv upgrade` command ([#&#8203;19678](astral-sh/uv#19678))
- Reject Git revisions in `uv upgrade` ([#&#8203;19742](astral-sh/uv#19742))

##### Configuration

- Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`, `UV_NO_INSTALL_LOCAL` ([#&#8203;19323](astral-sh/uv#19323))

##### Performance

- Speed up discovery of large workspaces ([#&#8203;18311](astral-sh/uv#18311))

##### Bug fixes

- Allow unknown preview flags with a warning again ([#&#8203;19669](astral-sh/uv#19669))
- Apply dependency exclusions to direct requirements ([#&#8203;19699](astral-sh/uv#19699))
- Avoid following external symlinks during cache clean ([#&#8203;19682](astral-sh/uv#19682))
- Avoid following symlinks during cache prune ([#&#8203;19543](astral-sh/uv#19543))
- Fix Git cache keys for worktrees and packed refs ([#&#8203;19706](astral-sh/uv#19706))
- Make resolver error handling iterative to avoid stack overflows ([#&#8203;19695](astral-sh/uv#19695))
- Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows ([#&#8203;19703](astral-sh/uv#19703))
- Rebuild explicit local directory tool installs ([#&#8203;19591](astral-sh/uv#19591))
- Validate egg top-level entries as identifiers ([#&#8203;19679](astral-sh/uv#19679))

##### Documentation

- Document `--find-links` caching behavior ([#&#8203;19585](astral-sh/uv#19585))
- Add a small section for malware checks ([#&#8203;19680](astral-sh/uv#19680))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9naXRodWItcmVsZWFzZSIsInR5cGUvcGF0Y2giXX0=-->

Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/92
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zanieb zanieb zanieb left review comments
@konstin konstin konstin left review comments

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@zaniebot @zanieb @konstin