based on the regex above, this will match any relative url that contains at least one legal character, but allows illegal characters.

```
>>> import re
>>> foo = re.compile(r'[a-zA-Z0-9/_-]+')
>>> foo.match('abc !@#$%^&*()')
<_sre.SRE_Match object at 0x7f3690e87718>
```
You can fix this by adding ```^``` at the beginning and ```$``` at the end of the regex. This also suggests that we are missing some test cases.