If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900

exhuma · 2013-10-30T09:17:50Z

Here's an example:

from flask import Flask
app = Flask(__name__)

@app.route('/<urlvar>')
def hello_world(urlvar):
    return 'Hello World! ' + repr(urlvar)

if __name__ == '__main__':
    app.run(debug=True)

When running:

curl http://localhost:5000/aaa%2Fbbb

I would expect to see:

Hello World! u'aaa/bbb'

Instead I get:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server.  If you entered the URL manually please check your spelling and try again.</p>

I tested this against Flask 0.9 and Flask 0.10.1. Both had the same error.

While searching for existing bug reports, I came across this: pallets/werkzeug#21

Is this related? If yes, what's the status?

In any case, being a WSGI spec problem or not, this is behaviour is incorrect!

The text was updated successfully, but these errors were encountered:

exhuma · 2013-10-30T09:27:25Z

Ehm. I just realised that using the path type annotation, would solve this. I still believe that a %2F should not be considered a path separator. The question still stands though: Is there any chance that this will be improved on in the future? Or is it an issue with the WSGI spec?

fengsp · 2013-10-30T09:41:39Z

You can try:
pprint.pprint(request.environ),
where you can see that 'PATH_INFO': '/aa/a',
I think WSGI does this.

exhuma · 2013-10-30T09:57:48Z

I have just come across another weird thing: When I use @app.route('/<path:urlvar>') it works when running the builtin server. When deploying behind mod_wsgi it stops working. But in an unexpected way. Behind mod_wsgi this works now:

curl -i "http://routing-manager/route/1.2.3.4/22"

But this does not:

curl -i "http://routing-manager/route/1.2.3.4%2F22"

Note, it's a simple REST service, retrieving information about IP routes. They are written in CIDR notation, which contains a slash. The client sends requests which are properly encoded (with %2F), so I should get this working. Worst case, I could investigate URL rewriting in Apache? But that would be an extremely ugly hack for something the server side should do properly :(

exhuma · 2013-10-30T10:23:11Z

I tracked this down to the apache directive AllowEncodedSlashes. Setting it to On worked. Setting it to NoDecode leves the decoding to the application developer.

So, in the end, this problem seems to be twofold... On the one hand, Flask/Wekzeug handles %2f exactly like it does /. You can work around this by using the path converter. Maybe it can be solved by writing a custom converter (which I just found). I have not tested that yet though. Using path might lead to ambiguities if you have two elements in the path which contain slashes. I don't expect this to happen often though.

On the other hand, apache httpd refuses encoded slashes by default returning a 404 error. This is very misleading and hard to track down.

For now, I have solved my problem with the path workaround. But I will leave this open for now, as I am curious to hear what the stance of the Flask devs is on the fact that Flask treats a %2f as a /. ;)

ghost · 2013-11-02T10:01:05Z

@exhuma The WSGI layer is on the Apache side, so the problem is caused by Apache.
I'd really like to know if it works on Nginx/uWSGI.

coldfire-x · 2013-11-02T15:33:56Z

@Giio, i just tried uwsgi + nginx, from uwsgi's log i can see the path passed from nginx to uwsgi is is GET /aaa%2Fffff, but when it passed to flask, the path_info in environ is 'PATH_INFO': '/aaa/ffff', but the request_uri is correct as 'REQUEST_URI': '/aaa%2Fffff'. So i think this path decode is done in wsgi layer.

Mattias- · 2013-12-27T17:38:12Z

I opened a pull request to werkzeug that addresses this issue.
Regardless if it's getting merged or not you can check it out to see what you need to patch at:
pallets/werkzeug#478

mitsuhiko · 2014-02-08T22:27:01Z

This is a limitation in WSGI and there is nothing I can do about that.

pawl · 2014-05-21T06:26:15Z

To get past this for now, I double URL encoded the URL.

There's a guide with a few hacks here: http://www.leakon.com/archives/865

fluffy-critter · 2015-08-01T09:58:02Z

Not to add more to a long-closed issue, but for what it's worth, Passenger's WSGI implementation does not unescape URL-encoded characters before forwarding it along in PATH_INFO. This would seem to be a bug in Passenger (assuming that WSGI says that PATH_INFO should be pre-urldecoded), but I wrote up a workaround on StackOverflow to make it behave the same in that context as in Flask's local server.

ramasco · 2020-02-05T16:45:13Z

If you encode once / will be %2F, then the parameter you get in flask is decoded and appears as a / so it look you have an extra parameter in the url. But if you encode three times in javascript and decoding twice in python it will work (it is a workaround but it will fix this issue):

in javascript
export const multipleEncode = (name) => { //flask decode one so if you send one encode / become %2F that becomes a / so we need double encoding return encodeURIComponent(encodeURIComponent(encodeURIComponent(encodeURIComponent(name)))); };
you will send multipleEncode (nameWithSlashes);

in python
from urllib import parse as urllib_parse def multiple_decode(parameter, info): if parameter is None: return parameter parameter_unquoted=urllib_parse.unquote(urllib_parse.unquote(parameter)) return parameter_unquoted

This was referenced Dec 27, 2013

Routing considers quoted slashes (%2F) as slashes. pallets/werkzeug#477

Closed

Moved unquoting of slashes in url to after routing pallets/werkzeug#478

Closed

mitsuhiko closed this as completed Feb 8, 2014

davidism mentioned this issue Jan 20, 2015

Extra slashes causes route error #1323

Closed

joshfriend mentioned this issue Jan 31, 2015

404 when string argument contains '%2F' flask-restful/flask-restful#393

Closed

marians mentioned this issue Apr 7, 2015

Detail view for key containing slash in name cannot be opened marians/rebrow#5

Closed

joshfriend mentioned this issue Jul 29, 2015

Memegen fails to service an image if %2F is used in the macro-text jacebrowning/memegen#71

Closed

jgehrcke mentioned this issue Feb 24, 2016

http/wsgi.py: do not unquote path before injecting into environ benoitc/gunicorn#1211

Closed

tumregels mentioned this issue May 28, 2017

Nginx uwsgi supervisor DormyMo/SpiderKeeper#26

Open

ThiefMaster mentioned this issue Oct 28, 2017

Percent encoded forward slash is stil treated as a URL component delimiter #2507

Closed

pbugni mentioned this issue Jan 10, 2018

Remove path: parameters from route uwcirg/truenth-portal#1777

Merged

niklasl mentioned this issue May 31, 2018

Escape double slash in path (except for 'https?://') libris/lxlviewer#104

Merged

heartsucker mentioned this issue Jul 1, 2018

Add journalist interface API freedomofpress/securedrop#3619

Merged

2 tasks

ghost mentioned this issue Mar 10, 2019

Create an example listing objects with a prefix. googleapis/google-cloud-cpp#2183

Merged

olivercoad mentioned this issue Aug 13, 2019

URL Decoding on server is not correct check-face/checkface#18

Closed

pallets locked as resolved and limited conversation to collaborators Feb 5, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900

If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900

exhuma commented Oct 30, 2013

exhuma commented Oct 30, 2013

fengsp commented Oct 30, 2013

exhuma commented Oct 30, 2013

exhuma commented Oct 30, 2013

ghost commented Nov 2, 2013

coldfire-x commented Nov 2, 2013

Mattias- commented Dec 27, 2013

mitsuhiko commented Feb 8, 2014

pawl commented May 21, 2014

fluffy-critter commented Aug 1, 2015

ramasco commented Feb 5, 2020 •

edited

Loading

If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900

If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900

Comments

exhuma commented Oct 30, 2013

exhuma commented Oct 30, 2013

fengsp commented Oct 30, 2013

exhuma commented Oct 30, 2013

exhuma commented Oct 30, 2013

ghost commented Nov 2, 2013

coldfire-x commented Nov 2, 2013

Mattias- commented Dec 27, 2013

mitsuhiko commented Feb 8, 2014

pawl commented May 21, 2014

fluffy-critter commented Aug 1, 2015

ramasco commented Feb 5, 2020 • edited Loading

ramasco commented Feb 5, 2020 •

edited

Loading