diff --git a/test/unit/common/middleware/test_tempurl.py b/test/unit/common/middleware/test_tempurl.py index 91114f90e2..22b4a14cb2 100644 --- a/test/unit/common/middleware/test_tempurl.py +++ b/test/unit/common/middleware/test_tempurl.py @@ -34,6 +34,7 @@ import itertools import mock import unittest import hashlib +from six.moves.urllib.parse import quote from time import time, strftime, gmtime from swift.common.middleware import tempauth, tempurl @@ -343,7 +344,7 @@ class TestTempURL(unittest.TestCase): key = 'abc' hmac_body = '%s\n%s\n%s' % (method, expires, path) sig = hmac.new(key, hmac_body, hashlib.sha1).hexdigest() - req = self._make_request(path, keys=[key], environ={ + req = self._make_request(quote(path), keys=[key], environ={ 'QUERY_STRING': 'temp_url_sig=%s&temp_url_expires=%s' % ( sig, expires)}) self.tempurl.app = FakeApp(iter([('200 Ok', (), '123')])) diff --git a/test/unit/common/test_swob.py b/test/unit/common/test_swob.py index f97941fa8d..ff8136721e 100644 --- a/test/unit/common/test_swob.py +++ b/test/unit/common/test_swob.py @@ -747,14 +747,8 @@ class TestRequest(unittest.TestCase): hacker = 'account-name\n\nfoo
' # url injection test quoted_hacker = quote(hacker) - req = swift.common.swob.Request.blank('/v1/' + hacker) - resp = req.get_response(test_app) - self.assertEqual(resp.status_int, 401) - self.assertTrue('Www-Authenticate' in resp.headers) - self.assertEqual('Swift realm="%s"' % quoted_hacker, - resp.headers['Www-Authenticate']) - req = swift.common.swob.Request.blank('/v1/' + quoted_hacker) + self.assertIn(hacker, req.environ['PATH_INFO']) # sanity check resp = req.get_response(test_app) self.assertEqual(resp.status_int, 401) self.assertTrue('Www-Authenticate' in resp.headers) @@ -916,11 +910,11 @@ class TestRequest(unittest.TestCase): self.assertEqual(_test_split_path('/a/c/', 2), ['a', 'c']) self.assertEqual(_test_split_path('/a/c/', 2, 3), ['a', 'c', '']) try: - _test_split_path('o\nn e', 2) + _test_split_path('o%0an e', 2) except ValueError as err: self.assertEqual(str(err), 'Invalid path: o%0An%20e') try: - _test_split_path('o\nn e', 2, 3, True) + _test_split_path('o%0an e', 2, 3, True) except ValueError as err: self.assertEqual(str(err), 'Invalid path: o%0An%20e')