validate kernelspec names

allow only: ascii letters, numbers, period, hyphen, underscore.

Author: minrk

docs/kernels.rst

@@ -108,6 +108,9 @@ locations:
 The user location takes priority over the system locations, and the case of the
 names is ignored, so selecting kernels works the same way whether or not the
 filesystem is case sensitive.
+Since kernelspecs show up in URLs and other places,
+they are required to be simple names, only containing ASCII letters and numbers,
+and the simple separators: ``-``, ``.``, ``_``.
 
 Other locations may also be searched if the :envvar:`JUPYTER_PATH` environment
 variable is set.

jupyter_client/kernelspec.py

@@ -6,6 +6,7 @@
 import io
 import json
 import os
+import re
 import shutil
 import warnings
 
@@ -20,6 +21,7 @@
 
 NATIVE_KERNEL_NAME = 'python3' if PY3 else 'python2'
 
+
 class KernelSpec(HasTraits):
     argv = List()
     display_name = Unicode()
@@ -54,19 +56,43 @@ def to_json(self):
         """
         return json.dumps(self.to_dict())
 
+
+_kernel_name_pat = re.compile(r'^[a-z0-9._\-]+$', re.IGNORECASE)
+
+def _is_valid_kernel_name(name):
+    """Check that a kernel name is valid."""
+    # quote is not unicode-safe on Python 2
+    return _kernel_name_pat.match(name)
+
+
+_kernel_name_description = "Kernel names can only contain ASCII letters and numbers and these separators: -._"
+
+
 def _is_kernel_dir(path):
     """Is ``path`` a kernel directory?"""
     return os.path.isdir(path) and os.path.isfile(pjoin(path, 'kernel.json'))
 
+
 def _list_kernels_in(dir):
     """Return a mapping of kernel names to resource directories from dir.
 
     If dir is None or does not exist, returns an empty dict.
     """
     if dir is None or not os.path.isdir(dir):
         return {}
-    return {f.lower(): pjoin(dir, f) for f in os.listdir(dir)
-                        if _is_kernel_dir(pjoin(dir, f))}
+    kernels = {}
+    for f in os.listdir(dir):
+        path = pjoin(dir, f)
+        if not _is_kernel_dir(path):
+            continue
+        key = f.lower()
+        if not _is_valid_kernel_name(key):
+            warnings.warn("Invalid kernelspec directory name (%s): %s",
+                _kernel_name_description, path, stacklevel=3,
+            )
+        kernels[key] = path
+    return kernels
+
 
 class NoSuchKernel(KeyError):
     def __init__(self, name):
@@ -75,6 +101,7 @@ def __init__(self, name):
     def __str__(self):
         return "No such kernel named {}".format(self.name)
 
+
 class KernelSpecManager(LoggingConfigurable):
 
     kernel_spec_class = Type(KernelSpec, config=True,
@@ -242,10 +269,12 @@ def install_kernel_spec(self, source_dir, kernel_name=None, user=False,
         if not kernel_name:
             kernel_name = os.path.basename(source_dir)
         kernel_name = kernel_name.lower()
-        
+        if not _is_valid_kernel_name(kernel_name):
+            raise ValueError("Invalid kernel name %r.  %s" % (kernel_name, _kernel_name_description))
+
         if user and prefix:
             raise ValueError("Can't specify both user and prefix. Please choose one or the other.")
-        
+
         if replace is not None:
             warnings.warn(
                 "replace is ignored. Installing a kernelspec always replaces an existing installation",

jupyter_client/tests/test_kernelspec.py

@@ -1,3 +1,4 @@
+# coding: utf-8
 """Tests for the KernelSpecManager"""
 
 # Copyright (c) Jupyter Development Team.
@@ -141,3 +142,23 @@ def test_remove_kernel_spec_app(self):
         )
         out, _ = p.communicate()
         self.assertEqual(p.returncode, 0, out.decode('utf8', 'replace'))
+
+    def test_validate_kernel_name(self):
+        for good in [
+            'julia-0.4',
+            'ipython',
+            'R',
+            'python_3',
+            'Haskell-1-2-3',
+        ]:
+            assert kernelspec._is_valid_kernel_name(good)
+        
+        for bad in [
+            'has space',
+            u'ünicode',
+            '%percent',
+            'question?',
+        ]:
+            assert not kernelspec._is_valid_kernel_name(bad)
+
+