Handle runs of delimiters in filenames

tests/unit/forklift/test_legacy.py

@@ -20,7 +20,6 @@
 from cgi import FieldStorage
 from unittest import mock
 
-import pkg_resources
 import pretend
 import pytest
 
@@ -2324,6 +2323,8 @@ def test_upload_fails_with_diff_filename_same_blake2(
             ("no-way-{version}.tar.gz", "no"),
             ("no_way-{version}-py3-none-any.whl", "no"),
             ("no_way-{version}-py3-none-any.egg", "no"),
+            # multiple delimiters
+            ("foo__bar-{version}-py3-none-any.whl", "foo-.bar"),
         ],
     )
     def test_upload_fails_with_wrong_filename(
@@ -2369,10 +2370,7 @@ def test_upload_fails_with_wrong_filename(
         assert resp.status == (
             "400 Start filename for {!r} with {!r}.".format(
                 project.name,
-                pkg_resources.safe_name(project.name)
-                .lower()
-                .replace(".", "_")
-                .replace("-", "_"),
+                project.normalized_name.replace("-", "_"),
             )
         )
 
@@ -2791,16 +2789,29 @@ def storage_service_store(path, file_path, *, meta):
             pretend.call("warehouse.upload.ok", tags=["filetype:bdist_wheel"]),
         ]
 
+    @pytest.mark.parametrize(
+        "project_name, filename_prefix",
+        [
+            ("flufl.enum", "flufl_enum"),
+            ("foo-.bar", "foo_bar"),
+        ],
+    )
     def test_upload_succeeds_pep427_normalized_filename(
-        self, monkeypatch, db_request, pyramid_config, metrics
+        self,
+        monkeypatch,
+        db_request,
+        pyramid_config,
+        metrics,
+        project_name,
+        filename_prefix,
     ):
         user = UserFactory.create()
         EmailFactory.create(user=user)
-        project = ProjectFactory.create(name="flufl.enum")
+        project = ProjectFactory.create(name=project_name)
         RoleFactory.create(user=user, project=project)
 
-        filename = "flufl_enum-1.0.0-py3-none-any.whl"
-        filebody = _get_whl_testdata(name="flufl_enum", version="1.0.0")
+        filename = f"{filename_prefix}-1.0.0-py3-none-any.whl"
+        filebody = _get_whl_testdata(name=filename_prefix, version="1.0.0")
 
         @pretend.call_recorder
         def storage_service_store(path, file_path, *, meta):

warehouse/forklift/legacy.py

@@ -26,7 +26,6 @@
 import packaging.utils
 import packaging.version
 import packaging_legacy.version
-import pkg_resources
 import sentry_sdk
 import wtforms
 import wtforms.validators
@@ -1215,16 +1214,8 @@ def file_upload(request):
     # Ensure the filename doesn't contain any characters that are too 🌶️spicy🥵
     _validate_filename(filename)
 
-    def _normalize_filename(filename):
-        return (
-            pkg_resources.safe_name(filename)
-            .lower()
-            .replace(".", "_")
-            .replace("-", "_")
-        )
-
     # Extract the project name from the filename and normalize it.
-    filename_prefix = _normalize_filename(
+    filename_prefix = (
         # For wheels, the project name is normalized and won't contain hyphens, so
         # we can split on the first hyphen.
         filename.partition("-")[0]
@@ -1234,8 +1225,12 @@ def _normalize_filename(filename):
         else filename.rpartition("-")[0]
     )
 
+    # Normalize the prefix in the filename. Eventually this should be unnecessary once
+    # we become more restrictive in what we permit
+    filename_prefix = filename_prefix.lower().replace(".", "_").replace("-", "_")
+
     # Make sure that our filename matches the project that it is being uploaded to.
-    if (prefix := _normalize_filename(project.name)) != filename_prefix:
+    if (prefix := project.normalized_name.replace("-", "_")) != filename_prefix:
         raise _exc_with_message(
             HTTPBadRequest,
             f"Start filename for {project.name!r} with {prefix!r}.",