From bc04c9b3db31bd17463756cb0ae09c08771e7bc3 Mon Sep 17 00:00:00 2001 From: meejah Date: Sat, 16 Nov 2019 21:19:41 -0700 Subject: [PATCH] detech empty pathname components, hopefully the same way as Nevow --- src/allmydata/test/web/test_web.py | 2 +- src/allmydata/web/directory.py | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/src/allmydata/test/web/test_web.py b/src/allmydata/test/web/test_web.py index 3889a3937..1ca3c2d43 100644 --- a/src/allmydata/test/web/test_web.py +++ b/src/allmydata/test/web/test_web.py @@ -1737,7 +1737,7 @@ class Web(WebMixin, WebErrorMixin, testutil.StallMixin, testutil.ReallyEqualMixi return d # XXX this 'fails' (as it should), but not with '409 Conflict' ... - def _test_PUT_NEWFILEURL_blocked(self): + def test_PUT_NEWFILEURL_blocked(self): d = self.PUT(self.public_url + "/foo/blockingfile/new.txt", self.NEWFILE_CONTENTS) d.addBoth(self.shouldFail, error.Error, "PUT_NEWFILEURL_blocked", diff --git a/src/allmydata/web/directory.py b/src/allmydata/web/directory.py index 7c2ef2586..23b315555 100644 --- a/src/allmydata/web/directory.py +++ b/src/allmydata/web/directory.py @@ -112,6 +112,14 @@ class DirectoryNodeHandler(ReplaceMeMixin, Resource, object): # or no further children) renders "this" page name = name.decode('utf8') if not name: + # replicating Nevow behavior that complains about "empty + # path segments" .. but twisted.web sends in "name=None" + # for a URL like "/foo/bar/" as well as "/foo//bar" + # (i.e. a trailing slash means "name=None" as well) + if b'//' in req.path: + raise EmptyPathnameComponentError( + u"The webapi does not allow empty pathname components, i.e. a double slash", + ) return self d = self.node.get(name) d.addBoth(self._got_child, req, name)