Repository navigation
PYTHON-5873 Reject whitespace in ObjectId hex strings - #3134
Open
GoldenEmperor1177 wants to merge 1 commit into
Open
GoldenEmperor1177 wants to merge 1 commit into
GoldenEmperor1177 wants to merge 1 commit into
Conversation
bytes.fromhex() skips ASCII whitespace, and ObjectId only checked that the string has 24 characters. A string like "0123 0011" therefore created an ObjectId shorter than 12 bytes, and a string of 24 spaces created an empty one. ObjectId.is_valid() returned True for them, and ObjectId.generation_time raised struct.error. Check the length of the decoded bytes too, so such strings raise InvalidId.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-5873
Changes in this PR
ObjectId(str)only checked that the string has 24 characters, butbytes.fromhex()skips ASCII whitespace. SoObjectId("0123 0011")created an ObjectId shorter than 12 bytes, and
ObjectId(" " * 24)created anempty one.
ObjectId.is_valid()returnedTruefor them, andgeneration_timeraisedstruct.error.The fix checks the length of the decoded bytes as well, so these strings raise
InvalidId. A string that decodes to 12 bytes has 24 hex digits, so it cannotcontain whitespace, and only inputs that previously produced broken ObjectIds
change behaviour. No API change. Added a changelog entry.
AI disclosure: I used an AI assistant (Claude Code) to help find the cause,
write the fix and the tests. I read the change and I understand it.
Test Plan
Added
test_from_hex_whitespaceand two cases intest_is_validintest/test_objectid.py. They fail without the fix and pass with it. I also ranthe other tests that don't need a server (
test_bson,test_json_util,test_bson_corpus,test_dbref,test_son,test_binary,test_code,test_decimal128,test_timestamp), andruff,ruff formatandmypyonthe changed files. I did not run the tests that need a running mongod.
Checklist
Checklist for Author
Checklist for Reviewer