From dc96e45d35cf4670f0e98068cda8f88dc3c06a8c Mon Sep 17 00:00:00 2001
From: Mathew Kadambatt <49642721+mathewOracle@users.noreply.github.com>
Date: Tue, 8 Sep 2026 13:54:50 +0530
Subject: [PATCH] Stop uuid() from accepting urn:/braced forms via dead-code
 fallback

`uuid()` parsed input with the stdlib `UUID()` constructor and fell back
to a strict regex only "if UUID(value) is falsy":

    return UUID(value) or re.match(r"^[0-9a-fA-F]{8}-...$", value)

A successfully-constructed `UUID` object is always truthy (it defines no
`__bool__`/`__len__`), so the `or re.match(...)` branch can never run.
In practice this means the actual acceptance criteria was "whatever
Python's UUID() constructor accepts", not the regex the code appears to
enforce -- and UUID() accepts considerably more than this validator
documents or tests, e.g.:

    >>> uuid('urn:uuid:2bc1c94f-0deb-43e9-92a1-4775189ec9f8')
    True   # should be rejected
    >>> uuid('{2bc1c94f-0deb-43e9-92a1-4775189ec9f8}')
    True   # should be rejected

Neither form appears in the docstring, the tests, or any prior issue/PR
I could find (checked via GitHub search for "uuid" -- the closest,
#112/#175, are about supporting hyphen-less hex, which this fix keeps
working).

Fix: drop the UUID()-based parsing entirely and validate with the regex
directly, extended to also accept the already-tested hyphen-less form.
This is a strict subset of what the old code intended to accept (per
its own regex and docstring), a superset check would have been
speculative; verified nothing currently-valid becomes invalid.

Verification:
- All 8 existing `test_uuid.py` cases still pass.
- Added 2 regression cases (`urn:uuid:...`, `{...}`) to the existing
  invalid-input parametrize list; confirmed they fail against the
  unpatched code (reverted locally to check) and pass with the fix.
- Non-string inputs (int, float, bool, list, dict, None) still resolve
  to `ValidationError` rather than crashing -- `TypeError` from
  `re.match` on a non-string is already caught by the `@validator`
  decorator in `utils.py`, so no new exception handling was needed.
- Full suite: `pytest tests/` -- 897 passed (895 baseline + 2 new).
- `pytest --doctest-modules src/validators/` -- 57 passed, doctest for
  `uuid` unaffected.
- `ruff format --check`, `ruff check`, and `pyright` all clean on the
  changed files (matches this repo's `pycqa.yaml` CI job exactly).

Found via targeted review of validator internals after differential
fuzzing across the library's public functions, not from a filed issue.
AI-assisted (Code Puppy); reproduced, root-caused, fixed, and verified
against both the old and new code before opening this.
---
 src/validators/uuid.py | 12 ++++++------
 tests/test_uuid.py     |  7 +++++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/validators/uuid.py b/src/validators/uuid.py
index ca6b1ba0..a3515d11 100644
--- a/src/validators/uuid.py
+++ b/src/validators/uuid.py
@@ -35,9 +35,9 @@ def uuid(value: Union[str, UUID], /):
         return False
     if isinstance(value, UUID):
         return True
-    try:
-        return UUID(value) or re.match(
-            r"^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$", value
-        )
-    except ValueError:
-        return False
+    # Deliberately not delegating to the stdlib UUID() constructor here:
+    # it accepts far more than this validator documents or tests, e.g.
+    # `urn:uuid:...`-prefixed and `{braced}` forms, and any UUID version
+    # (not just v4). A regex keeps acceptance limited to the plain
+    # (optionally dashed) hex form shown in the docstring and tests.
+    return bool(re.match(r"^[0-9a-fA-F]{8}-?([0-9a-fA-F]{4}-?){3}[0-9a-fA-F]{12}$", value))
diff --git a/tests/test_uuid.py b/tests/test_uuid.py
index b4f40d29..84d68725 100644
--- a/tests/test_uuid.py
+++ b/tests/test_uuid.py
@@ -32,6 +32,13 @@ def test_returns_true_on_valid_uuid(value: Union[str, UUID]):
         ("2bc1c94f-0deb-43e9-92a1-4775189ec9f",),
         ("gbc1c94f-0deb-43e9-92a1-4775189ec9f8",),
         ("2bc1c94f 0deb-43e9-92a1-4775189ec9f8",),
+        # Regression: the previous implementation delegated to the stdlib
+        # UUID() constructor, which is far more permissive than this
+        # validator's own docstring/regex -- it also accepts urn:-prefixed
+        # and {braced} forms, neither of which were ever documented,
+        # tested, or intended to pass here.
+        ("urn:uuid:2bc1c94f-0deb-43e9-92a1-4775189ec9f8",),
+        ("{2bc1c94f-0deb-43e9-92a1-4775189ec9f8}",),
     ],
 )
 def test_returns_failed_validation_on_invalid_uuid(value: Union[str, UUID]):