Path parameters (url encoded) containing newlines are not processed properly while using {param:path}

[apolopeix]

I am using FastAPI '0.103.1' using starlette '0.27.0' and I found the following issue.

Defining a route with a path like:

from fastapi import FastAPI

app = FastAPI()


@app.get("/{id:path}/something")
async def my_handler(id: str):
    return {"id": id}

I get the following responses:

# Using paths
curl "http://localhost:8000/a///n/something"
{"id":"a///n"}

# Using new line without URL encoding
curl "http://localhost:8000/a\n/something"
{"id":"a\\n"}

However, when the request is URL encoded, I get the following error:

# Using new line with URL encoding
curl "http://localhost:8000/a%0A/something"
{"detail":"Not Found"}

Checking the code it looks like the starlette/routing matcher is not able to make it match.

Can someone help me to clarify if it is a bug on scarlette? Or is it something that can be achieved by doing something else?

[apolopeix]

Just to narrow down the issue, I tried without using the {id:path} and the URL-encoded parameter is properly handled:

@app.get("/{id}/something")
async def my_handler(id: str):
    return {"id": id}

The result:

curl "http://localhost:8000/a%0A/something"
{"id":"a\n"}

[alex-oleshkevich]

New line chars are illegal in the URLs - https://stackoverflow.com/questions/7109143/what-characters-are-valid-in-a-url
If you still want to use them - url encode it.

[apolopeix]

Thanks for your reply.

As stated in the example, the new line character is already URL encoded. So unfortunately that is not a valid answer.