Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adds quote of path to adhere to PEP3333 #38

Merged
merged 1 commit into from
Jul 18, 2024
Merged

Conversation

m00sey
Copy link
Contributor

@m00sey m00sey commented Jul 10, 2024

There is a potential for requests using UTF-8 characters within the request path to cause a crash with WSGI.

    # PEP 3333 specifies that the PATH_INFO variable is always
    # "bytes tunneled as latin-1" and must be encoded back.
    #
    # NOTE(kgriffs): The decoded path may contain UTF-8 characters.
    # But according to the WSGI spec, no strings can contain chars
    # outside ISO-8859-1. Therefore, to reconcile the URI
    # encoding standard that allows UTF-8 with the WSGI spec
    # that does not, WSGI servers tunnel the string via
    # ISO-8859-1, e.g.:
    #
    #   tunnelled_path = path.encode('utf-8').decode('iso-8859-1')
    
    # perf(vytas): Only decode the tunnelled path in case it is not ASCII.
    #   For ASCII-strings, the below decoding chain is a no-op.
    # If not isascii(path):
        path = path.encode('iso-8859-1').decode('utf-8', 'replace')

Is the relevant PEP, thanks @pfeairheller

Signed-off-by: Kevin Griffin <griffin.kev@gmail.com>
@SmithSamuelM SmithSamuelM merged commit 2927925 into ioflo:main Jul 18, 2024
2 checks passed
@SmithSamuelM
Copy link
Contributor

SmithSamuelM commented Jul 18, 2024

@m00sey See #39 created new version of hio on pypi and tag v0.6.14 with fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants