bpo-19094: Raise TypeError in urljoin(), urlparse(), and urlsplit() for inappropriate types

Author: jacobtylerwalls

Doc/library/urllib.parse.rst

@@ -220,6 +220,11 @@ or on combining URL components into a URL string.
    .. versionchanged:: 3.15
       Added the *missing_as_none* parameter.
 
+   .. versionchanged:: 3.15
+       Values for ``url`` and ``scheme`` other than strings or bytes raise
+      :exc:`TypeError` if true or :exc:`DeprecationWarning` if false (to be
+      changed to :exc:`TypeError` in future versions of Python).
+
 .. _WHATWG spec: https://url.spec.whatwg.org/#concept-basic-url-parser
 
 
@@ -315,6 +320,11 @@ or on combining URL components into a URL string.
       query parameter separator. This has been changed to allow only a single
       separator key, with ``&`` as the default separator.
 
+   .. versionchanged:: 3.15
+      Values for ``qs`` and ``separator`` other than strings or bytes raise
+      :exc:`TypeError` if true or :exc:`DeprecationWarning` if false (to be
+      changed to :exc:`TypeError` in future versions of Python).
+
 
 .. function:: urlunsplit(parts)
               urlunsplit(parts, *, keep_empty)
@@ -374,6 +384,11 @@ or on combining URL components into a URL string.
    .. versionchanged:: 3.15
       Added the *keep_empty* parameter.
 
+   .. versionchanged:: 3.15
+      Items in ``parts`` other than strings or bytes raise
+      :exc:`TypeError` if true or :exc:`DeprecationWarning` if false (to be
+      changed to :exc:`TypeError` in future versions of Python).
+
 
 .. function:: urljoin(base, url, allow_fragments=True)
 
@@ -417,6 +432,11 @@ or on combining URL components into a URL string.
 
       Behavior updated to match the semantics defined in :rfc:`3986`.
 
+   .. versionchanged:: 3.15
+      Values for ``base`` and ``url`` other than strings or bytes raise
+      :exc:`TypeError` if true or :exc:`DeprecationWarning` if false (to be
+      changed to :exc:`TypeError` in future versions of Python).
+
 
 .. function:: urldefrag(url, *, missing_as_none=False)
 
@@ -447,6 +467,11 @@ or on combining URL components into a URL string.
    .. versionchanged:: 3.15
       Added the *missing_as_none* parameter.
 
+   .. versionchanged:: 3.15
+      Values other than strings or bytes raise
+      :exc:`TypeError` if true or :exc:`DeprecationWarning` if false (to be
+      changed to :exc:`TypeError` in future versions of Python).
+
 .. function:: unwrap(url)
 
    Extract the url from a wrapped URL (that is, a string formatted as

Doc/whatsnew/3.15.rst

@@ -1761,6 +1761,12 @@ New deprecations
     :func:`issubclass`, but warnings were not previously emitted if it was
     merely imported or accessed from the :mod:`!typing` module.
 
+* :mod:`urllib`:
+
+  * Providing anything but a string or bytes object to :mod:`urllib.parse`
+    functions expecting strings or bytes now raises :exc:`DeprecationWarning`
+    if the value tests false, or :exc:`TypeError` if it tests true.
+    (Contributed by Jacob Walls in :issue:`19094`.)
 
 * ``__version__``
 

Lib/test/test_urlparse.py

@@ -1255,7 +1255,14 @@ def test_mixed_types_rejected(self):
         with self.assertRaisesRegex(TypeError, "Cannot mix str"):
             urllib.parse.urljoin(b"http://python.org", "http://python.org")
 
+    def test_non_string_true_values_rejected(self):
+        # True values raise informative TypeErrors
+        msg = "Expected a string or bytes object: got <class "
+        with self.assertRaisesRegex(TypeError, msg):
+            urllib.parse.urlsplit(1, b'http')
+
     def _check_result_type(self, str_type, str_args):
+        num_args = len(str_type._fields)
         bytes_type = str_type._encoded_counterpart
         self.assertIs(bytes_type._decoded_counterpart, str_type)
         bytes_args = tuple_encode(str_args)
@@ -1987,6 +1994,27 @@ def test_to_bytes_deprecation(self):
         self.assertEqual(str(cm.warning),
                          'urllib.parse.to_bytes() is deprecated as of 3.8')
 
+    def test_falsey_deprecation(self):
+        pattern = (
+            "Providing false values other than strings or bytes to urllib.parse "
+            "is deprecated: got <class "
+        )
+        cases = [
+            (urllib.parse.urljoin, ['http://www.python.org', []]),
+            (urllib.parse.urljoin, [[], b'docs']),
+            (urllib.parse.urlparse, [b'www.python.org', None]),
+            (urllib.parse.urlparse, [{}, '']),
+            (urllib.parse.urlsplit, [0, b'http']),
+            (urllib.parse.urlsplit, [b'http://www.python.org', None]),
+            (urllib.parse.urldefrag, [{}]),
+            (urllib.parse.urlunparse, [[None, b'www.python.org', None, None, None, None]]),
+            (urllib.parse.urlunsplit, [['http', 0, '', '', '']]),
+        ]
+        for callable, args in cases:
+            with self.subTest(callable=callable):
+                with self.assertWarnsRegex(DeprecationWarning, pattern):
+                    callable(*args)
+
 
 def str_encode(s):
     if s is None:

Lib/urllib/parse.py

@@ -131,6 +131,14 @@ def _coerce_args(*args):
             else:
                 if isinstance(arg, str) != str_input:
                     raise TypeError("Cannot mix str and non-str arguments")
+                if not hasattr(arg, 'decode'):
+                    if arg:
+                        raise TypeError(f"Expected a string or bytes object: got {type(arg)}")
+                    else:
+                        warnings.warn(
+                            f"Providing false values other than strings or bytes "
+                            f"to urllib.parse is deprecated: got {type(arg)}",
+                            DeprecationWarning, stacklevel=3)
     if str_input is None:
         for arg in args:
             if arg is not None:
@@ -697,12 +705,12 @@ def _urlunsplit(scheme, netloc, url, query, fragment):
 def urljoin(base, url, allow_fragments=True):
     """Join a base URL and a possibly relative URL to form an absolute
     interpretation of the latter."""
+    base, url, _coerce_result = _coerce_args(base, url)
     if not base:
-        return url
+        return _coerce_result(url)
     if not url:
-        return base
+        return _coerce_result(base)
 
-    base, url, _coerce_result = _coerce_args(base, url)
     bscheme, bnetloc, bpath, bquery, bfragment = \
             _urlsplit(base, None, allow_fragments)
     scheme, netloc, path, query, fragment = \

Misc/NEWS.d/next/Library/2021-06-11-20-00-16.bpo-19094.rMRoIL.rst

@@ -0,0 +1,3 @@
+Providing anything but a string or bytes object to :mod:`urllib.parse`
+functions expecting strings or bytes now raises :exc:`DeprecationWarning`
+if the value tests false, or :exc:`TypeError` if it tests true.