Repository navigation
PYTHON-5873 Reject whitespace in ObjectId hex strings - #3134
Open
GoldenEmperor1177 wants to merge 1 commit into
Open
GoldenEmperor1177 wants to merge 1 commit into
GoldenEmperor1177 wants to merge 1 commit into
Conversation
bytes.fromhex() skips ASCII whitespace, and ObjectId only checked that the string has 24 characters. A string like "0123 0011" therefore created an ObjectId shorter than 12 bytes, and a string of 24 spaces created an empty one. ObjectId.is_valid() returned True for them, and ObjectId.generation_time raised struct.error. Check the length of the decoded bytes too, so such strings raise InvalidId.
NoahStapp
requested changes
Oct 20, 2026
NoahStapp
left a comment
Contributor
There was a problem hiding this comment.
Thanks for the contribution! Two small test changes, otherwise great!
Comment on lines
+66
to
+69
| # The string form of an ObjectId round-trips. | ||
| oid = ObjectId() | ||
| self.assertEqual(oid, ObjectId(str(oid))) | ||
|
|
Contributor
There was a problem hiding this comment.
This isn't related to the rest of the test. Existing tests already verify that ObjectId round-trips, and the ObjectId being created here doesn't contain any whitespace.
Comment on lines
+167
to
+168
| self.assertFalse(ObjectId.is_valid("0123 0011")) | ||
| self.assertFalse(ObjectId.is_valid(" " * 24)) |
Contributor
There was a problem hiding this comment.
Suggested change
| self.assertFalse(ObjectId.is_valid("0123 0011")) | |
| self.assertFalse(ObjectId.is_valid(" " * 24)) | |
| self.assertFalse(ObjectId.is_valid("0123 0011")) | |
| self.assertFalse(ObjectId.is_valid("00 " * 8)) | |
| self.assertFalse(ObjectId.is_valid("01\n" * 8)) | |
| self.assertFalse(ObjectId.is_valid(" " * 24)) |
Consistency across both test cases.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-5873
Changes in this PR
ObjectId(str)only checked that the string has 24 characters, butbytes.fromhex()skips ASCII whitespace. SoObjectId("0123 0011")created an ObjectId shorter than 12 bytes, and
ObjectId(" " * 24)created anempty one.
ObjectId.is_valid()returnedTruefor them, andgeneration_timeraisedstruct.error.The fix checks the length of the decoded bytes as well, so these strings raise
InvalidId. A string that decodes to 12 bytes has 24 hex digits, so it cannotcontain whitespace, and only inputs that previously produced broken ObjectIds
change behaviour. No API change. Added a changelog entry.
AI disclosure: I used an AI assistant (Claude Code) to help find the cause,
write the fix and the tests. I read the change and I understand it.
Test Plan
Added
test_from_hex_whitespaceand two cases intest_is_validintest/test_objectid.py. They fail without the fix and pass with it. I also ranthe other tests that don't need a server (
test_bson,test_json_util,test_bson_corpus,test_dbref,test_son,test_binary,test_code,test_decimal128,test_timestamp), andruff,ruff formatandmypyonthe changed files. I did not run the tests that need a running mongod.
Checklist
Checklist for Author
Checklist for Reviewer