werkzeug: regex URL converter matches incorrect value

I have the following code in a Flask App using Werkzeug


# Redirect requests for the older image URLs to new URLs
@app.route(
    '/static/images/2019/<regex("(privacy|jamstack|capabilities)"):folder>/<image>'
)
def redirect_old_hero_images(folder, image):
    return redirect("/static/images/2020/%s/%s" % (folder, image)), 301

prior to 2.2.0 this would allow the following redirect:

/static/images/2019/jamstack/random.png

to

/static/images/2020/jamstack/random.png

Now however it incorrectly sends us to:

/static/images/2020/jamstack/jamstack

Pinning werkzeug to 2.1.2 fixes the issue.

Environment:

  • Python version: 3.8
  • Werkzeug version: 2.2.0 and 2.2.1

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 22 (12 by maintainers)

Commits related to this issue

Most upvoted comments

@pgjones this seems like an issue, because I’d expect a custom converter might legitimately want to use a character group []. We should figure out why that doesn’t work now.

It looks like that’s the same issue, you have a capturing group in your regex. The regexes for converters are intended to be fairly simple, with further validation done in to_python. Your solution to accept a string and do the check in the view is fine too.