Reject deep-linking payloads with a trailing newline - #5387

Fixes #5386

create_deep_linked_url validated the payload with re.match(r"^[A-Za-z0-9_-]+$", payload). In Python, $ also matches just before a trailing newline, so "valid\n" passed and the returned URL contained a literal newline, even though the documented payload character set is A-Z, a-z, 0-9, _ and -.

Change

• src/telegram/helpers.py: use re.fullmatch(r"[A-Za-z0-9_-]+", payload), so the whole string must match the documented set. group=True goes through the same check.

Tests

tests/test_helpers.py::TestHelpers::test_create_deep_linked_url now also asserts that "hello\n", "hello\r" and "hello\nworld" raise ValueError for both group=False and group=True.

Verified locally: pytest tests/test_helpers.py -q -> 183 passed; with only helpers.py reverted, the new assertions fail with DID NOT RAISE ValueError for "hello\n". ruff check and ruff format --check are clean on both files.

Check-list for PRs

• Created new or adapted existing unit tests
• Documented code changes according to the CSI standard
• Added myself alphabetically to AUTHORS.rst (optional) - not done, can add if you prefer
• Added new classes & modules to the docs and all suitable __all__ s - not applicable
• Checked the Stability Policy in case of deprecations or changes to documented behavior - this only makes the documented character set enforced, no API change