UriTemplate.match() cannot read back prefix{.ext} when ext holds a dot, though nothing else can claim it #3693

Activity

1. claude

   added

   bugSomething isn't workingSomething isn't working

   v2Affects the v2 line (2.x on main)Affects the v2 line (2.x on main)

   on Oct 12, 2026
2. Ben-Home commented on Oct 13, 2026

   

   Ben-Home

   on Oct 13, 2026 · Hidden as spam

   show commentMore actions
3. chrikrah commented on Oct 20, 2026

   

   chrikrah

   on Oct 20, 2026

   Author

   More actions

   One cost I left out of the report. With the anchored branch bounded by /?#, file{.ext} matches file.tar.gz, which file{+path} already matches, so a server registering both resolves by registration order at resource_manager.py:119. That overlap exists on 2af9e30 today for a single dot:

   $ python3 -I probe.py src/mcp/shared/uri_template.py    # exported from 2af9e30, unchanged
   file{.ext} file.zip {'ext': 'zip'}
   file{+path} file.zip {'path': '.zip'}
   file{.ext} file.tar.gz None
   file{+path} file.tar.gz {'path': '.tar.gz'}
   

   @maxisbey, you wrote that limitation in #2356. I'd narrow the docstring limitation to the unanchored case, because this widens an overlap that already exists and {name}{.ext} stays unmatched. Would you take that, or keep the docstring as written? @Kludex, copying you since you're merging this week.
4. sunhouy commented on Nov 5, 2026

   

   sunhouy

   on Nov 5, 2026

   More actions

   I hit this while looking for something to work on and it reproduces exactly as described, so I traced it and have a patch that passes locally. Dropping the findings here first since require-linked-issue.yml wants the issue assigned before a PR can stay open.

   Root cause. _STOP_CHARS[Operator.label] is "./?#" — the label operator lists its own separator as a stop char. In _scan_suffix, earliest walks left until it lands on a stop char, so for file{.ext} it parks just after the last .; the anchored branch then does start < earliest -> return None. But {.var} means "emit a dot, then the value", so ext="tar.gz" expands to .tar.gz. When the expression follows a literal, that literal already pins where the value begins and there is no capture to its left that could claim the dot, so the dots inside the value can only belong to the value.

   Shape of the fix, in _scan_suffix, tested before earliest is computed:

   own_separator_stops = not var.explode and var.operator == "." and prev is not None
   scan_stops = stops
   if own_separator_stops:
       scan_stops = "".join(c for c in stops if c != _OPERATOR_SPECS["."].separator)

   Then the existing scan uses scan_stops instead of stops. The other three branches are untouched.

   On @Ben-Home's first point: the condition keys on var.operator == "." per expression, not on the explode flag, so {+var} cannot pick up the restriction through a shared branch. I checked that explicitly — {+path} against a.b, a/b and a/b?c#d behaves identically before and after (a/b?c#d returns None in both, that's the query/fragment split upstream, not this scan).

   On @chrikrah's docstring question: I read that as a yes, so the match() docstring no longer states the limitation flatly. It now says the round-trip holds for {.var} right after a literal, and that the dot is ambiguous again once another capture sits to its left:

   template	URI	before	after
   file{.ext}	file.tar.gz	None	{'ext': 'tar.gz'}
   backup://nightly{.ext}	backup://nightly.tar.gz	None	{'ext': 'tar.gz'}
   {name}{.ext}	f.tar.gz	{'name': 'f.tar', 'ext': 'gz'}	unchanged
   file{.a}{;b}	file.tar.gz;b=1	None	{'a': 'tar.gz', 'b': '1'}

   Tests added: three cases to the test_roundtrip_expand_then_match parametrization, plus one test pinning that {name}{.ext} stays ambiguous and one pinning that structural chars like ; still terminate the value. Running the file: 4 failed / 308 passed against the original source, 312 passed with the patch.

   Two things I did not do, in fairness to what was asked:

   • The parametrized cartesian from point 2 is still just a handful of hand-picked pairs, not (expression form × value set). If that's a requirement for landing this I'll build it out.
   • The overlap precedence from point 3 is resource_manager.py:119 territory, so I left it alone. Worth noting the direction though: making match() accept more URIs does widen what a server will route to file{.ext}, and if someone gates access on the captured value the more permissive match is the one that answers.

   Happy to send the PR here if it gets assigned, or to open it right away if a maintainer prefers to add help wanted instead.