Fix minor holes in PEP-508 name validation

[rmartin16]

Changes

• This resolves a hole in the recommended implementation of name validation from PEP-508 to avoid allowing non-ASCII values.

The regex (run with re.IGNORECASE) is:

^([A-Z0-9]|[A-Z0-9][A-Z0-9._-]*[A-Z0-9])$

• The implementation of re.IGNORECASE is ostensibly coercing the case of the input because it will match on non-ASCII.
  • This matters for, at least, İ (0x130) and K (0x212a).

>>> import re
>>> PEP508_NAME_RE = re.compile(r"^([A-Z0-9]|[A-Z0-9][A-Z0-9._-]*[A-Z0-9])$", re.IGNORECASE)
>>> 
>>> bool(PEP508_NAME_RE.match("helloworld"))
True
>>> bool(PEP508_NAME_RE.match("İstanbul"))
True
>>> bool(PEP508_NAME_RE.match("Kelvin"))
True
>>> bool(PEP508_NAME_RE.match("Æolia"))
False
>>> bool(PEP508_NAME_RE.match("jalapeño"))
False
>>> bool(PEP508_NAME_RE.match("Beyoncé"))
False
>>> bool(PEP508_NAME_RE.match("naïve"))
False

Related

• App Name Validation Can Allow Names that Produce an Invalid pyproject.toml #1011

PR Checklist:

• All new features have been tested
• All new features have been documented
• I have read the CONTRIBUTING.md file
• I will abide by the code of conduct

[rmartin16]

PEP-508 says PyPI uses this regex...and indeed, it appears they do.

However, packaging.requirements.Requirement doesn't use re.IGNORECASE....so, even if you get such a package on to PyPI, it seems likely pip or another tool will reject it at some point.

[freakboy3742]

That's an odd discrepancy, but I can't argue with the practicality. A couple of minor clarification suggestions, including preserving the symmetry of the dotless-i test case.