Merge pull request #96 from jayd3e/dict-is-too-liberal

Stricter checking for what is allowed as a Mapping object.

colander/__init__.py

@@ -510,7 +510,10 @@ def _get_unknown(self):
 
     def _validate(self, node, value):
         try:
-            return dict(value)
+            if hasattr(value, 'items'):
+                return dict(value)
+            else:
+                raise TypeError('Does not implement dict-like functionality.')
         except Exception as e:
             raise Invalid(node,
                           _('"${val}" is not a mapping type: ${err}',

colander/tests/test_colander.py

@@ -529,10 +529,27 @@ def test_ctor_good_unknown(self):
     def test_deserialize_not_a_mapping(self):
         node = DummySchemaNode(None)
         typ = self._makeOne()
+
+        # None
         e = invalid_exc(typ.deserialize, node, None)
         self.assertTrue(
             e.msg.interpolate().startswith('"None" is not a mapping type'))
 
+        # list
+        e = invalid_exc(typ.deserialize, node, [])
+        self.assertTrue(
+            e.msg.interpolate().startswith('"[]" is not a mapping type'))
+
+        # str
+        e = invalid_exc(typ.deserialize, node, "")
+        self.assertTrue(
+            e.msg.interpolate().startswith('"" is not a mapping type'))
+
+        # tuple
+        e = invalid_exc(typ.deserialize, node, ())
+        self.assertTrue(
+            e.msg.interpolate().startswith('"()" is not a mapping type'))
+
     def test_deserialize_null(self):
         import colander
         node = DummySchemaNode(None)