Skip to content

StaticRoute should unquote filename #1140

Closed
@crccheck

Description

Long story short

If I don't have web safe filenames (say I have a directory index), my browser turns "Darby uses the computer.jpg" into "Darby%20uses%20the%20computer.jpg", which StaticRoute will never find on the filesystem.

Expected behaviour

I expect to see

Actual behaviour

I get a 404 instead of a corgi.

Steps to reproduce

Take an existing static route with a working image. Add a space to the image, then add the same space to your url. That's not that helpful, but in the code, this change gets images to load again for me. I can attempt to turn it into a pull request, but not this week.

$ git rev-parse HEAD
671617dc4a343c18a26831c8941fd55b844ed977
diff --git a/aiohttp/web_urldispatcher.py b/aiohttp/web_urldispatcher.py
index 7b288fe..236701a 100644
--- a/aiohttp/web_urldispatcher.py
+++ b/aiohttp/web_urldispatcher.py
@@ -479,7 +479,7 @@ class StaticRoute(Route):

     @asyncio.coroutine
     def handle(self, request):
-        filename = request.match_info['filename']
+        filename = unquote(request.match_info['filename'])
         try:
             filepath = self._directory.joinpath(filename).resolve()
             filepath.relative_to(self._directory)

Your environment

Python 3.5.0+
aiohttp==0.22.5

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions