Closed
Description
If you run this simple server example :
import asyncio
from aiohttp import web
@asyncio.coroutine
def handle(request):
return webResponse(body=request.path.encode('utf8'))
@asyncio.coroutine
def init(loop):
app = web.Application(loop=loop)
app.router.add_route('GET', '/', handle)
srv = yield from loop.create_server(app.make_handler(), '127.0.0.1', 5555)
return srv
loop = asyncio.get_event_loop()
loop.run_until_complete(init(loop))
try:
loop.run_forever()
except KeyboardInterrupt:
passThe following requests will get a 200 OK with the considered path as content :
$ curl -X GET http://127.0.0.1:5555///
/
$ curl -X GET http://127.0.0.1:555//foo/
/
As you can see, the path of the URL is not well parsed.
This bug resides in the _splitted_path non-data descriptor which uses urlsplit on a path rather than a full URL. The consequence is a second segment interpreted as a network location if the first one is empty.
I've not quite investigated a fix at the moment, but _splitted_path only being used by raw_path and query_string seems to be a plea to use a fake scheme and netloc for urlsplit to behave the expected way.