#28796: reverse() coerces bytes in args/kwargs to str which adds "b" prefixes to
the ouput
-----------------------------+--------------------------------------
Reporter: Nick | Owner: nobody
Type: Bug | Status: new
Component: Core (URLs) | Version: 2.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------------------------
Old description:
> Suppose we have:
>
> hashed_msg = hmac.new(key, msg=message, digestmod=sha384)
> url = urlsafe_base64_encode(hashed.digest())
>
> Now url is a bytes object, say b'asdfwerqwefa'. In django 1.11, bytes-
> like objects could be placed in urls no problem, creating (say)
> localhost:8000/asdfwerqwefa
>
> However, in django 2.0, the url becomes (say)
>
> localhost:8000/b'asdfwerqwefa'
>
> which seems less 'urlsafe', as the quotes and the 'b' are added into the
> url. Shouldn't urlsafe_base64_encode now return a string, if bytes in
> urls now retain the quotes?
>
> I have created a full project which reproduces the bug here:
>
> https://github.com/NAThompson/urlsafe_bug
>
> To reproduce the bug, type:
>
> $ ./manage.py shell
> >>> import reproduce
>
> This bug is present in commit d90936f41a2d7a3361e51fc49be033ba0f05f458,
> but much before that the 'django.urls.path' doesn't exist, so bisection
> doesn't work cleanly.
New description:
Suppose we have:
{{{
import hmac
from hashlib import sha384
from django.utils.http import urlsafe_base64_encode
hashed_msg = hmac.new(b"secret", msg=b"qwerty", digestmod=sha384)
url = urlsafe_base64_encode(hashed_msg.digest())
}}}
Now url is a bytes object, say b'asdfwerqwefa'. In django 1.11, bytes-like
objects could be used in `reverse()`, creating (say)
localhost:8000/asdfwerqwefa
However, in Django 2.0, the url becomes (say)
localhost:8000/b'asdfwerqwefa'
which seems less 'urlsafe', as the quotes and the 'b' are added into the
url. Shouldn't urlsafe_base64_encode now return a string, if bytes in urls
now retain the quotes?
I have created a full project which reproduces the bug here:
https://github.com/NAThompson/urlsafe_bug
To reproduce the bug, type:
{{{
$ ./manage.py shell
>>> import reproduce
}}}
This bug is present in commit d90936f41a2d7a3361e51fc49be033ba0f05f458,
but much before that the 'django.urls.path' doesn't exist, so bisection
doesn't work cleanly.
--
Comment (by Tim Graham):
I think we could document the backwards incompatibility and point out the
solution to add `.decode()`, which should also work without older versions
of Django. Does it seem okay, Nick?
--
Ticket URL: <https://code.djangoproject.com/ticket/28796#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.8da0047c323a4e9b472accb058af4c1b%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
