Fix Azure Blob SAS signatures for encoded object paths - #2181
Fix Azure Blob SAS signatures for encoded object paths#2181nightcityblade wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Fixes Azure Blob SAS signature generation when blob paths are percent-encoded by decoding the object path only for the canonicalized resource in the string-to-sign, while keeping the returned CDN URL encoded.
Changes:
- Decode
object_pathfor SAS canonical resource generation usingurlunquote. - Add a regression test ensuring spaces are decoded in the string-to-sign but remain encoded in the returned URL.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| libcloud/storage/drivers/azure_blobs.py | Decodes the object path for the canonical resource used in SAS signing. |
| libcloud/test/storage/test_azure_blobs.py | Adds a test covering a blob name containing a space, validating signing vs URL encoding behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| obj = Object("file name.txt", 0, None, {}, {}, container, self.driver) | ||
|
|
||
| url = self.driver.get_object_cdn_url(obj) | ||
| string_to_sign = mock_hmac_new.call_args.args[1].decode("utf-8") |
There was a problem hiding this comment.
@nightcityblade, could you please check this revision?
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## trunk #2181 +/- ##
==========================================
- Coverage 83.59% 83.59% -0.00%
==========================================
Files 352 352
Lines 81854 81866 +12
Branches 8772 8773 +1
==========================================
+ Hits 68421 68431 +10
- Misses 10561 10562 +1
- Partials 2872 2873 +1
🚀 New features to boost your workflow:
|
|
Addressed in ce6f2ba: the test now reads the HMAC message from the msg keyword when present and otherwise falls back to the positional argument, avoiding dependence on one calling style. Focused Azure Blob tests: 2 passed. |
|
LGTM, could you add the information about this change in the CHANGES.rst file? |
Fix Azure Blob SAS signatures for encoded object paths
Description
Azure Blob SAS canonical resources must use the decoded object path when the
signature is calculated, while the returned URL must remain percent-encoded.
Decode the path only for the string-to-sign and add regression coverage for an
object name containing a space.
Fixes #1805.
For more information on contributing, please see Contributing
section of our documentation.
Status
Checklist (tick everything that applies)
black --check,isort --check-only, and focusedflake8passed)pytest -q libcloud/test/storage/test_azure_blobs.py: 86 passed)