[P2][bug] URL guard forbids SPACE (range(0x21) off-by-one), breaking inline query strings (#113) #119

Merged in #113 (cc7fd9b). Verified by execution against main on 2026-09-13 — confirmed live.

What is wrong

oilpriceapi/_url.py:36:

_FORBIDDEN_CHARS = frozenset("\\") | frozenset(chr(c) for c in range(0x21)) | {chr(0x7F)}

range(0x21) is 0x00–0x20 inclusive, so U+0020 SPACE is a forbidden path character. The stated intent in the comment above it is CR/LF request splitting and NUL — all of which are < 0x20. The range over-reaches by exactly one character.

Repro

from oilpriceapi._url import resolve_api_url
resolve_api_url("https://api.oilpriceapi.com", "/v1/prices?name=Brent Crude")

Measured:

ValidationError: Validation error for 'path': invalid value '/v1/prices?name=Brent Crude'

Before #113 this path went through urljoin to httpx, which percent-encoded the space and the request succeeded.

Why it matters

Any caller who builds a query string inline in the path now gets a hard failure where they previously got a working request. The SDK does this itself — oilpriceapi/resources/demo.py:53:

path = f"{path}?codes={','.join(codes)}"

which breaks the moment a code, or a caller-supplied value elsewhere, contains a space. This is a silent narrowing of the accepted path grammar shipped in a security fix, with no changelog entry and no version bump (version.py is still 1.13.0).

Suggested fix

Use range(0x20) so SPACE is permitted, keeping 0x00-0x1F and 0x7F forbidden:

_FORBIDDEN_CHARS = frozenset("\\") | frozenset(chr(c) for c in range(0x20)) | {chr(0x7F)}

A space cannot introduce an authority or split a request line — httpx percent-encodes it — so nothing the guard exists to stop is enabled by allowing it.

Add a case to tests/unit/test_request_origin_guard.py pinning that a space in the query string resolves rather than raising.