portolan-python 0.1.7__tar.gz → 0.1.8__tar.gz

{portolan_python-0.1.7 → portolan_python-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: portolan-python
-Version: 0.1.7
+Version: 0.1.8
 Summary: A lightweight Python implementation of the Portolan specification.
 Author: Portolan contributors
 License: Apache-2.0

{portolan_python-0.1.7 → portolan_python-0.1.8}/docs/distribution.md

@@ -8,8 +8,8 @@ preferred package index for published versions.
 Push a tag that matches the version in `pyproject.toml`:
 
 ```bash
-git tag v0.1.7
-git push origin v0.1.7
+git tag v0.1.8
+git push origin v0.1.8
 ```
 
 The release workflow runs the tests, builds both distributions, checks their
@@ -25,7 +25,7 @@ Install the wheel attached to a release:
 
 ```bash
 python -m pip install \
-  https://github.com/jemacchi/portolan-python/releases/download/v0.1.7/portolan_python-0.1.7-py3-none-any.whl
+  https://github.com/jemacchi/portolan-python/releases/download/v0.1.8/portolan_python-0.1.8-py3-none-any.whl
 ```
 
 This path needs no package index account.
@@ -35,7 +35,7 @@ This path needs no package index account.
 Install a published version from PyPI with:
 
 ```bash
-python -m pip install portolan-python==0.1.7
+python -m pip install portolan-python==0.1.8
 ```
 
 Omit the version constraint to install the latest published version.

{portolan_python-0.1.7 → portolan_python-0.1.8}/docs/examples.md

@@ -10,14 +10,14 @@ GitHub:
 
 ```bash
 python -m pip install \
-  https://github.com/jemacchi/portolan-python/releases/download/v0.1.7/portolan_python-0.1.7-py3-none-any.whl
+  https://github.com/jemacchi/portolan-python/releases/download/v0.1.8/portolan_python-0.1.8-py3-none-any.whl
 ```
 
 You can also install the source at a specific tag:
 
 ```bash
 python -m pip install \
-  "portolan-python @ git+https://github.com/jemacchi/portolan-python.git@v0.1.7"
+  "portolan-python @ git+https://github.com/jemacchi/portolan-python.git@v0.1.8"
 ```
 
 ## List collections and assets

{portolan_python-0.1.7 → portolan_python-0.1.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "portolan-python"
-version = "0.1.7"
+version = "0.1.8"
 description = "A lightweight Python implementation of the Portolan specification."
 readme = "README.md"
 requires-python = ">=3.10"

{portolan_python-0.1.7 → portolan_python-0.1.8}/src/portolan/registry.py

@@ -61,6 +61,9 @@ def load_registry_entries(
         registry_id = link.get("portolan_registry:id")
         if not isinstance(href, str) or not isinstance(registry_id, str):
             continue
+        resolved_url = urljoin(registry_url, href)
+        if not _is_remote_url(resolved_url):
+            continue
         status = link.get("portolan_registry:status")
         if status != "valid" and not include_stale:
             continue
@@ -72,7 +75,7 @@ def load_registry_entries(
         entries.append(
             RegistryCatalogEntry(
                 id=registry_id,
-                url=urljoin(registry_url, href),
+                url=resolved_url,
                 title=title if isinstance(title, str) else None,
                 status=status if isinstance(status, str) else None,
                 bbox=_horizontal_bbox(link.get("bbox")),
@@ -114,6 +117,11 @@ def _horizontal_bbox(value: object) -> tuple[float, float, float, float] | None:
     return (float(value[0]), float(value[1]), float(value[half]), float(value[half + 1]))
 
 
+def _is_remote_url(url: str) -> bool:
+    parsed = urlparse(url)
+    return parsed.scheme in {"http", "https"} and bool(parsed.netloc)
+
+
 def download_registry_catalog(
     catalog_url: str,
     output_dir: Path,

{portolan_python-0.1.7 → portolan_python-0.1.8}/tests/test_registry_api.py

@@ -178,6 +178,12 @@ def test_load_registry_entries_skips_invalid_link_shapes() -> None:
             {"rel": "item", "href": "https://example.test/item.json"},
             {"rel": "child", "href": "https://example.test/missing-id/catalog.json"},
             {"rel": "child", "href": 5, "portolan_registry:id": "bad-href"},
+            {
+                "rel": "child",
+                "href": "javascript:alert(1)",
+                "portolan_registry:id": "unsafe-scheme",
+                "portolan_registry:status": "valid",
+            },
             {
                 "rel": "child",
                 "href": "https://example.test/no-status/catalog.json",

{portolan_python-0.1.7 → portolan_python-0.1.8}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "portolan-python"
-version = "0.1.7"
+version = "0.1.8"
 source = { editable = "." }
 
 [package.optional-dependencies]