Repository navigation
Conversation
The KV store client built URLs with format!("lists/{key}/contains/{item}")
and Url::join, so a key or item containing '/', '?', '#' or '..' was
parsed as URL syntax: a '?' started a query string, a '#' cut the rest
off as a fragment, and '../' segments sent the request to a different
endpoint (delete_list_item("my-list", "../../sets/x") issued
DELETE /sets/x). Build these paths with path_segments_mut() instead, as
the admin client already does, so each key and item is one encoded
segment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The KV store client builds request paths with
base_url.join(&format!("lists/{key}/contains/{item}")), so keys and list items are parsed as URL syntax instead of being sent as values:list_contains_item("my-list", "https://example.com/a?b=1#top")requests/lists/my-list/contains/https:/example.com/awith queryb=1, and the#toppart is dropped.get_set("user:1/profile")requests/sets/user:1/profile.delete_list_item("my-list", "../../sets/x")sendsDELETE /sets/x, a different endpoint.This change adds a small
url(&[segments])helper onResolvedKvStoreConfigthat appends segments withpath_segments_mut(), the same approachadmin::transactionsuses forget_transaction, and uses it for every KV endpoint that takes a key or item. Plain keys likemy-keyoruser:1produce exactly the same URLs as before. One behavior note: a caller who was already percent-encoding keys themselves would now get them encoded twice.Testing:
get_set_key_is_one_encoded_path_segment,list_contains_item_encodes_key_and_item,delete_list_item_cannot_escape_the_list) that expect the encoded path. All three fail onmainand pass with this change.cargo test -p quicknode-sdk --lib: 289 passed.cargo fmt --all -- --checkandcargo clippy -p quicknode-sdk --lib --tests -- -D warningsare clean. I didn't build the Python/Node/Ruby bindings locally; the public method signatures are unchanged.I used an AI assistant while working on this, and reviewed and tested the change myself.