Reject a comma in a URL scheme

The scheme check used "+-." as a character range, so a comma was
accepted. The error text only allows letters, digits, "+", "-", and ".".

Author: SashaMIT

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Next
 
+* A URL scheme no longer accepts a comma. `+-.` in the scheme check was a character range, so `,` sat between `+` and `.`. ([#199](https://github.com/python-hyper/hyperlink/issues/199))
 * CPython 3.9 added to test matrix
 
 ## 21.0.0

src/hyperlink/_url.py

@@ -154,7 +154,8 @@ def __nonzero__(self):
     r"(\?(?P<query>[^#]*))?"
     r"(#(?P<fragment>.*))?$"
 )
-_SCHEME_RE = re.compile(r"^[a-zA-Z0-9+-.]*$")
+# Hyphen is last so it is a literal. "+-." would be the range from "+" to ".".
+_SCHEME_RE = re.compile(r"^[a-zA-Z0-9.+-]*$")
 _AUTHORITY_RE = re.compile(
     r"^(?:(?P<userinfo>[^@/?#]*)@)?"
     r"(?P<host>"

src/hyperlink/test/test_url.py

@@ -1261,6 +1261,11 @@ def test_wrong_constructor(self):
         with self.assertRaises(ValueError):
             # explicitly bad scheme not allowed
             URL("HTTP_____more_like_imHoTTeP")
+        with self.assertRaises(ValueError):
+            # "+-." is not a range, so a comma is not a scheme character
+            URL(scheme="ht,tp")
+        with self.assertRaises(ValueError):
+            URL.from_text("ht,tp://example.com")
 
     def test_encoded_userinfo(self):
         # type: () -> None