Skip to content

Having a : or @ in a route does not work#1552

Merged
fafhrd91 merged 1 commit intoaio-libs:masterfrom
arthurdarcet:colon-urls
Feb 6, 2017
Merged

Having a : or @ in a route does not work#1552
fafhrd91 merged 1 commit intoaio-libs:masterfrom
arthurdarcet:colon-urls

Conversation

@arthurdarcet
Copy link
Copy Markdown
Contributor

The URL escaping done for the request urls and in the router when adding resources should be consistent.
Currently, : and @ are considered "safe" by yarl and not escaped in request.rel_url.raw_path ; but the router does escape them and so the created resource never match:

import aiohttp
import aiohttp.web
import asyncio


async def server(loop):
	app = aiohttp.web.Application(loop=loop)
	app.router.add_get('/a-b', lambda _: aiohttp.web.Response(text="OK"))
	app.router.add_get('/a:b', lambda _: aiohttp.web.Response(text="nope"))
	app.router.add_get('/a%3Ab', lambda _: aiohttp.web.Response(text="still nope"))
	handler = app.make_handler()
	await loop.create_server(handler, '0.0.0.0', 8080)

async def main(loop):
	srv = await server(loop)
	async with aiohttp.get('http://0.0.0.0:8080/a-b') as resp:
		print('--->', resp.status)
	async with aiohttp.get('http://0.0.0.0:8080/a:b') as resp:
		print('--->', resp.status)
	async with aiohttp.get('http://0.0.0.0:8080/a%3Ab') as resp:
		print('--->', resp.status)

loop = asyncio.get_event_loop()
loop.run_until_complete(main(loop))

Output:

% python a.py
---> 200
---> 404
---> 404

I have updated the router to avoid using yarl.quote and use yarl.URL(…).raw_path instead, ensuring the escaping is consistent in both cases. (and I added a test that fails without this patch)

@codecov-io
Copy link
Copy Markdown

codecov-io commented Jan 23, 2017

Codecov Report

Merging #1552 into master will increase coverage by 0.34%.

@@            Coverage Diff             @@
##           master    #1552      +/-   ##
==========================================
+ Coverage   98.59%   98.94%   +0.34%     
==========================================
  Files          30       30              
  Lines        7055     6996      -59     
  Branches     1176     1169       -7     
==========================================
- Hits         6956     6922      -34     
+ Misses         58       37      -21     
+ Partials       41       37       -4
Impacted Files Coverage Δ
aiohttp/web_urldispatcher.py 99.8% <100%> (+0.19%)
aiohttp/streams.py 98.59% <ø> (-0.02%)
aiohttp/parsers.py 99.28% <ø> (-0.01%)
aiohttp/test_utils.py 100% <ø> (ø)
aiohttp/server.py 100% <ø> (ø)
aiohttp/web_server.py 100% <ø> (ø)
aiohttp/pytest_plugin.py 100% <ø> (ø)
aiohttp/web_reqrep.py 99.81% <ø> (+0.36%)
aiohttp/connector.py 98.33% <ø> (+0.47%)
... and 3 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1811685...d7f724b. Read the comment docs.

@fafhrd91
Copy link
Copy Markdown
Member

fafhrd91 commented Feb 6, 2017

thanks!

@fafhrd91 fafhrd91 merged commit d292d7e into aio-libs:master Feb 6, 2017
@arthurdarcet arthurdarcet deleted the colon-urls branch March 6, 2017 11:21
@lock
Copy link
Copy Markdown

lock bot commented Oct 29, 2019

This thread has been automatically locked since there has not been
any recent activity after it was closed. Please open a new issue for
related bugs.

If you feel like there's important points made in this discussion,
please include those exceprts into that new issue.

@lock lock bot added the outdated label Oct 29, 2019
@lock lock bot locked as resolved and limited conversation to collaborators Oct 29, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants