URL accepts ports above 65535 without raising InvalidURL

[10k11]

Summary

httpx.URL accepts ports outside the valid range 0-65535.

Repro

import httpx
httpx.URL("http://example.com:99999/").port   # 99999, no InvalidURL raised

The stdlib urllib.parse.urlparse(...).port raises ValueError: Port out of range 0-65535 for this input.

Expected

httpx.InvalidURL (e.g. "Invalid port") at URL construction, rather than failing later at connection time with a less clear error.

Checked on current master; I found no existing issue about this.

[kasparovabi]

The out-of-range port is not only accepted, it is also sent to a different port. On Linux the request to :99999 connects to port 34463 (99999 mod 65536).

The check that is missing is in normalize_port(). It only does int(port), so anything int() accepts gets through. The authority regex captures the port as .*, so nothing earlier filters it either. Because of int(), these inputs are also accepted:

input	httpx.URL(...).port	str(httpx.URL(...))	urlparse(...).port
http://127.0.0.1:99999/	99999	unchanged	ValueError: Port out of range 0-65535
http://127.0.0.1:-1/	-1	unchanged	ValueError
http://127.0.0.1:+81/	81	http://127.0.0.1:81/	ValueError
http://127.0.0.1:8_0/	None	http://127.0.0.1/	ValueError

The last row happens because int("8_0") == 80, which then matches the default port for http and is dropped.

I checked what happens at connect time with a local server bound to 34463 inside a python:3.13-slim container (Debian, glibc), on httpx 0.28.1 and on current master (b5addb6).

srv = http.server.HTTPServer(("127.0.0.1", 99999 % 65536), Handler)
...
httpx.get("http://127.0.0.1:99999/")
# -> 200 served by port 34463

socket.getaddrinfo("127.0.0.1", 99999, type=socket.SOCK_STREAM)[0][4]
# -> ('127.0.0.1', 34463)

So the failure the issue expects "later at connection time" does not happen on glibc. getaddrinfo truncates the numeric service to 16 bits and the connection succeeds on the wrong port. I only ran this on Linux/glibc and have not checked macOS or Windows resolvers.

Until normalize_port() validates the value, a request event hook can reject it before anything is sent.

import httpx

def check_port(request):
    port = request.url.port
    if port is not None and not 0 <= port <= 65535:
        raise httpx.InvalidURL(f"Port out of range 0-65535: {port}")

client = httpx.Client(event_hooks={"request": [check_port]})
client.get("http://127.0.0.1:99999/")
# httpx.InvalidURL: Port out of range 0-65535: 99999

This does not catch +81 or 8_0, because by the time the hook runs the URL has already been normalized to 81 and 80. A fix inside normalize_port() that requires ASCII digits (port.isascii() and port.isdigit()) and then checks 0 <= port_as_int <= 65535 would cover all four rows, and test_url_invalid_port in tests/models/test_url.py is the natural place for the extra cases.