Python: Support structured MIME subtypes in data URIs - #14304
Python: Support structured MIME subtypes in data URIs#14304Zhewen Tan (tandede) wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Expands the Data URI parsing logic to accept MIME subtypes containing structured syntax suffixes and vendor-tree subtypes (e.g., image/svg+xml, application/vnd.api+json).
Changes:
- Added unit tests covering MIME subtypes with
+suffixand vendor subtypes. - Relaxed the MIME subtype regex to allow additional valid characters.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| python/tests/unit/contents/test_data_uri.py | Adds regression tests for structured-suffix and vendor-subtype Data URIs. |
| python/semantic_kernel/contents/utils/data_uri.py | Updates the MIME type regex to accept richer subtype formats. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| pattern = "(((?P<mime_type>[a-zA-Z]+/[a-zA-Z0-9!#$&^_.+-]+)(?P<parameters>(;[a-zA-Z0-9]+=+[a-zA-Z0-9]+)*))?(;+(?P<data_format>.*)))?(,(?P<data_str>.*))" # noqa: E501 | ||
| match = re.match(pattern, data) |
| pattern = "(((?P<mime_type>[a-zA-Z]+/[a-zA-Z0-9!#$&^_.+-]+)(?P<parameters>(;[a-zA-Z0-9]+=+[a-zA-Z0-9]+)*))?(;+(?P<data_format>.*)))?(,(?P<data_str>.*))" # noqa: E501 | ||
| match = re.match(pattern, data) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 861112f49281
Model: claude-opus-4.8
Overview
This PR makes a single-line change at python/semantic_kernel/contents/utils/data_uri.py:138, widening the
MIME subtype regex character class from [a-zA-Z-]+ to [a-zA-Z0-9!#$&^_.+-]+ so registered structured
subtypes like image/svg+xml and application/vnd.api+json parse, plus two matching regression tests. The
change is strictly additive: the new class excludes the structural delimiters / ; , =, so no previously
accepted input parses differently and no new backtracking ambiguity is created. All nine existing negative
tests still raise, the full test_data_uri.py suite passes, and downstream consumers (BinaryContent,
ImageContent, AudioContent) receive mime_type through the unchanged to_string()/to_dict() paths.
The residual ReDoS and RFC-token-completeness concerns are pre-existing, not worsened by this PR, and are
already captured in the open reviewer feedback threads; no publishable defect remains.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Motivation and Context
DataUri.from_data_uri()rejects valid MIME subtypes containing structured syntax suffixes or vendor facets because its parser only accepts letters and hyphens. This prevents common values such asimage/svg+xmlandapplication/vnd.api+jsonfrom being used in data URIs.Description
Expand the MIME subtype character class to accept digits and the punctuation allowed in registered subtype names. Add regression cases covering SVG and vendor JSON data URIs, including MIME type preservation and payload decoding.
Validation:
Contribution Checklist