Prevent {} and tighten parsing of {:} (#1715)

Fixes #1711

Author: jayvdb

docs/changelog/1711.bugfix.rst

@@ -0,0 +1 @@
+Prevent ``{}`` and require ``{:`` is only followed by ``}``. - by :user:`jayvdb`

src/tox/config/__init__.py

@@ -1819,18 +1819,24 @@ def _replace_match(self, match):
             start, end = match.span()
             return match.string[start:end]
 
-        # special case: all empty values means ":" which is os.pathsep
-        if not any(g.values()):
+        full_match = match.group(0)
+        # ":" is swallowed by the regex, so the raw matched string is checked
+        if full_match.startswith("{:"):
+            if full_match != "{:}":
+                raise tox.exception.ConfigError(
+                    "Malformed substitution with prefix ':': {}".format(full_match),
+                )
+
             return os.pathsep
 
         if sub_value == "posargs":
             return self.reader.getposargs(match.group("default_value"))
 
-        try:
-            sub_type = g["sub_type"]
-        except KeyError:
+        sub_type = g["sub_type"]
+        if not sub_type and not sub_value:
             raise tox.exception.ConfigError(
-                "Malformed substitution; no substitution type provided",
+                "Malformed substitution; no substitution type provided. "
+                "If you were using `{}` for `os.pathsep`, please use `{:}`.",
             )
 
         if not sub_type and not g["default_value"] and sub_value == "/":

tests/unit/config/test_config.py

@@ -603,6 +603,33 @@ def test_getstring_single(self, newconfig):
         x = reader.getstring("hello", "world")
         assert x == "world"
 
+    def test_substitution_empty(self, newconfig):
+        config = newconfig(
+            """
+            [mydefault]
+            key2={}
+        """,
+        )
+        reader = SectionReader("mydefault", config._cfg, fallbacksections=["mydefault"])
+        assert reader is not None
+        with pytest.raises(tox.exception.ConfigError, match="no substitution type provided"):
+            reader.getstring("key2")
+
+    def test_substitution_colon_prefix(self, newconfig):
+        config = newconfig(
+            """
+            [mydefault]
+            key2={:abc}
+        """,
+        )
+        reader = SectionReader("mydefault", config._cfg, fallbacksections=["mydefault"])
+        assert reader is not None
+        with pytest.raises(
+            tox.exception.ConfigError,
+            match="Malformed substitution with prefix ':'",
+        ):
+            reader.getstring("key2")
+
     def test_missing_substitution(self, newconfig):
         config = newconfig(
             """
@@ -612,7 +639,7 @@ def test_missing_substitution(self, newconfig):
         )
         reader = SectionReader("mydefault", config._cfg, fallbacksections=["mydefault"])
         assert reader is not None
-        with pytest.raises(tox.exception.ConfigError):
+        with pytest.raises(tox.exception.ConfigError, match="substitution key '.*' not found"):
             reader.getstring("key2")
 
     def test_getstring_fallback_sections(self, newconfig):