Should we escape slashs on path?

[Kludex]

First check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.
• After submitting this, I commit to:
  • Read open issues with questions until I find 2 issues where I can help someone and add a comment to help there.
  • Or, I already hit the "watch" button in this repository to receive notifications and I commit to help at least 2 people that ask questions in the future.
  • Implement a Pull Request for a confirmed bug.

Description

This is more a question/feature request. Currently, we are not able to withstand forward slashes in the Path. Do we want to have that available?

Minimal example

Having those two endpoints:

from fastapi import FastAPI

app = FastAPI()

@app.post("/{path}")
def post_method(path: str):
    return "ok"

@app.post("/{path}/{another}")
def post_method_another(path: str, another: str):
    return "not ok"

I want to be able to access the first endpoint with the following request:
curl -X POST "http://localhost:8000/hahahaha%2Fahhaa" -H "accept: application/json" -d ""

The %2F is known way to escape forward slashes.

Additional context

This issue was brought by @hang15 on our gitter and on StackOverflow.

[tiangolo]

Yeah, I think this StackOverflow answer has good info pointing to the W3C recommendations which would be sort of the authority (I don't think the URL RFC have something specific about that).

So I think that should be the behavior. Nevertheless, this is actually handled in Starlette directly, not in FastAPI. But it would be a valid Starlette bug/feature request.

[ycd]

Well, we can actually achieve that by creating a custom route,

from fastapi import FastAPI, Body, APIRouter, Request, Response
from typing import Callable
from fastapi.routing import APIRoute
from pydantic import BaseModel
import json
from pprint import pprint as print


class CustomRoute(APIRoute):
    def __init__(self, *args, **kwargs) -> None:
        super().__init__(*args, **kwargs)

    def get_route_handler(self) -> Callable:
        original_route_handler = super().get_route_handler()

        async def custom_route_handler(request: Request) -> Response:
            old_scope = request.scope["raw_path"].decode("utf-8")
            new_scope = old_scope.replace("%2F", "/").encode("utf-8")
            request.scope["raw_path"] = new_scope


            response = await original_route_handler(request)

            return response

        return custom_route_handler


app = FastAPI()
router = APIRouter(route_class=CustomRoute)


class TestModel(BaseModel):
    name: str


@router.post("/{some}/{other_path}")
async def dummy(some: str, other_path: str):
    return {
        "some": some,
        "other_path": other_path,
    }


app.include_router(router)

This changes the raw_path on fly

curl -X POST "http://127.0.0.1:8000/asdf%2Fasdf" -H  "accept: application/json" -d ""
{"some":"asdf","other_path":"asdf"}

[SamDM]

The answer posted by ycd does not seem to work, and does not seem to answer the original question either.
I.e., given the endpoint:

@app.post("/{path}")
def post_method(path: str):
    return "ok"

You are not able to call it with:

curl -X POST "http://localhost:8000/hahahaha%2Fahhaa" -H "accept: application/json" -d ""

I've put logging statements in the custom_route_handler above and this code is not being called when the path component contains an escaped slash %2F. A 404 is send back before even reaching that point in the code.

The reason the code above works is because the %2F is translated to slash before looking for the correct endpoint. In fact, the example above works without the custom router.

[mielvds]

I ran into the same issue and it took me a while to find out what was happening. "/{path:path}" works to some extend, but then it's no longer possible to match something like /hahahaha%2Fahhaa/name. Like some other frameworks, FastAPI(or Starlette) seems to decode the URL before matching routes, which I think is strictly speaking a bug. If a clients wants hahahaha%2Fahhaa to be interpreted as hahahaha/ahhaa, it wouldn't escape it. The RFC's seem to agree with that interpretation. Is there a corresponding issue at https://github.com/encode/starlette? Would FastAPI consider a setting to disable this behaviour?

[mgwidmann]

I was able to get this working with the following workaround:

import re
from typing import Tuple
from urllib.parse import quote_plus, unquote_plus

from fastapi import APIRouter, FastAPI
from fastapi.routing import APIRoute
from fastapi.testclient import TestClient
from starlette.routing import Match
from starlette.types import Scope


class RawPathRoute(APIRoute):
    def matches(self, scope: Scope) -> Tuple[Match, Scope]:
        raw_path: str | None = None
        if "raw_path" in scope and scope["raw_path"] is not None:
            raw_path = scope["raw_path"].decode("utf-8")
        elif "aws.event" in scope and "path" in scope["aws.event"]:
            raw_path = scope["aws.event"]["path"]

        if raw_path is None:
            raise HTTPException(status_code=500, detail="Internal routing error")

        new_path = re.sub(r"\?.*", "", raw_path)
        scope["path"] = new_path
        return super().matches(scope)


router = APIRouter(prefix="/mypath", route_class=RawPathRoute)


@router.get("/{path1}/{path2}")
def mypath(path1: str, path2: str):
    print(f"Paths: {unquote_plus(path1)} and {unquote_plus(path2)}")


app = FastAPI()
app.include_router(router)

client = TestClient(app)


def test_example():
    path1 = "some/path/here"
    path2 = "another/path/here"
    response = client.get(f"/mypath/{quote_plus(path1)}/{quote_plus(path2)}")
    assert response.status_code == 200

Then running it in pytest we can see the paths come in separately and decoded:

$ pytest -rP test_example.py
========================================================= test session starts =========================================================
platform darwin -- Python 3.11.6, pytest-7.4.4, pluggy-1.4.0
rootdir: /Users/matt/code/python/test-example/src/test/
configfile: pyproject.toml
plugins: env-1.1.3, cov-4.1.0, docker-1.0.1, anyio-3.7.1, typeguard-2.13.3
collected 1 item                                                                                                                      

test_example.py .                                                                                                                [100%]
=============================================================== PASSES ================================================================
____________________________________________________________ test_example _____________________________________________________________
-------------------------------------------------------- Captured stdout call ---------------------------------------------------------
Paths: some/path/here and another/path/here
========================================================= 1 passed in 10.08s ==========================================================

[mielvds]

Thanks @mgwidmann! Still think this should be the default behaviour though. I responded on the starlette repo encode/starlette#826 (comment), but the issue is closed. Might open a new one.

[mgwidmann]

I've updated it to work in AWS Lambda as the raw_path was not available there for some reason. There may be other places where this code doesn't work as expected but the general idea applies as a workaround until it can be fixed upstream.