fix(catalogs): raise catalog error, not raw ValueError, on a malformed URL#3435
Merged
Merged
Conversation
…d URL CatalogStackBase._validate_catalog_url read parsed.hostname, which raises ValueError on a malformed authority (e.g. an unclosed ipv6 bracket "https://[::1"). every other reject path raises the class catalog error, so the raw ValueError leaked to the caller. wrap the parse + hostname access and convert ValueError to the normal error via cls._error. twin of the bundler fix in adapters._validate_remote_url.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes URL validation in the shared catalog stack so malformed authorities (e.g., invalid IPv6 bracket forms) don’t leak a raw ValueError and instead raise the expected catalog error type. This makes specify integration catalog add <url> fail cleanly and consistently with other invalid-URL paths.
Changes:
- Wrap
urlparse()+parsed.hostnameaccess inCatalogStackBase._validate_catalog_urland convertValueErrorintocls._error(...). - Reuse the parsed
hostnamevalue for localhost detection and host presence checks. - Add regression coverage for malformed bracketed hosts (unclosed IPv6 bracket, bracketed non-IP host).
Show a summary per file
| File | Description |
|---|---|
src/specify_cli/catalogs.py |
Converts malformed-URL ValueError into the catalog stack’s normal error type and reuses hostname safely. |
tests/integrations/test_integration_catalog.py |
Adds regression tests ensuring malformed catalog URLs are rejected with IntegrationCatalogError (not a raw ValueError). |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Low
Collaborator
|
Thank you! |
kanfil
added a commit
to tikalk/agentic-sdlc-spec-kit
that referenced
this pull request
Jul 11, 2026
Upstream merge (30 commits, 3 releases 0.12.9-0.12.11): - invoke_separator parse-success fix (github#3304) - Windows Store python3 stub skip + _interpreter_runs() probe (github#3385) - SKILL.md frontmatter control char escape via yaml_quote() (github#3399) - chained expression filters left-to-right refactor (github#3339) - refresh_shared_templates preserves recovered files (github#3378) - Goose yaml skill placeholder resolution (github#3374) - bundled version pin enforcement (github#3377) - integration test home isolation (github#3144) - py: script type in command templates (github#3403) - configurable shell step timeout (github#3404) - find plans in nested spec directories (github#3405) - plan.md phase numbering fix (github#3416) - PowerShell -Number 0 honor via ContainsKey (github#3412) - workflow.yml non-string scalar validation (github#3421) - plan-template.md self-referencing path fix (github#3417) - pre-commit config + trailing whitespace cleanup (github#3430) - malformed URL error handling (github#3433/github#3435/github#3437) - agent-context nested plan.md discovery (github#3301) - community catalog additions (EARS, Figma) (github#3407/github#3408) 9 conflicts resolved: pyproject.toml, integrations/base.py, agents.py, forge/__init__.py, hermes/__init__.py, create-new-feature-branch.ps1, test_git_extension.py, test_base.py, test_integration_devin.py. Template-to-preset alignment: added py: script lines to 6 preset commands, removed stale Phase 1 agent context line from plan preset, fixed phase numbering. Pre-merge fix: wrapped bare make_typer import with fallback. Assisted-by: opencode (model: glm-5.2, autonomous)
kanfil
added a commit
to tikalk/agentic-sdlc-spec-kit
that referenced
this pull request
Jul 11, 2026
Upstream merge (30 commits, 3 releases 0.12.9-0.12.11): - invoke_separator parse-success fix (github#3304) - Windows Store python3 stub skip + _interpreter_runs() probe (github#3385) - SKILL.md frontmatter control char escape via yaml_quote() (github#3399) - chained expression filters left-to-right refactor (github#3339) - refresh_shared_templates preserves recovered files (github#3378) - Goose yaml skill placeholder resolution (github#3374) - bundled version pin enforcement (github#3377) - integration test home isolation (github#3144) - py: script type in command templates (github#3403) - configurable shell step timeout (github#3404) - find plans in nested spec directories (github#3405) - plan.md phase numbering fix (github#3416) - PowerShell -Number 0 honor via ContainsKey (github#3412) - workflow.yml non-string scalar validation (github#3421) - plan-template.md self-referencing path fix (github#3417) - pre-commit config + trailing whitespace cleanup (github#3430) - malformed URL error handling (github#3433/github#3435/github#3437) - agent-context nested plan.md discovery (github#3301) - community catalog additions (EARS, Figma) (github#3407/github#3408) 9 conflicts resolved: pyproject.toml, integrations/base.py, agents.py, forge/__init__.py, hermes/__init__.py, create-new-feature-branch.ps1, test_git_extension.py, test_base.py, test_integration_devin.py. Template-to-preset alignment: added py: script lines to 6 preset commands, removed stale Phase 1 agent context line from plan preset, fixed phase numbering. Pre-merge fix: wrapped bare make_typer import with fallback. Assisted-by: opencode (model: glm-5.2, autonomous)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes #3434
CatalogStackBase._validate_catalog_urlreadparsed.hostname, which raisesValueErroron a malformed authority (unclosed ipv6 brackethttps://[::1, bracketed non-ip hosthttps://[not-an-ip]). the method's other reject paths all raise the class catalog error, so the raw ValueError leaked instead of failing cleanly. reachable viaspecify integration catalog add <url>.twin of the bundler validator fix (#3432 / #3433).
fix: wrap the parse + hostname access and convert
ValueErrorto the normal error viacls._error, then reuse the parsed hostname for the existing scheme/host checks.added a regression test (
test_malformed_url_rejected_cleanly) covering an unclosed ipv6 bracket and a bracketed non-ip host. i confirmed it fails on the pre-fix code by stashing the source and re-running (raw ValueError leaks); the url-validation suite passes with the fix.