Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

An href with `%252F` (a UID holding `/`) comes back under the wrong URL

Chiusa
  • Qualcosa non va?
#835 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Una pull request collegata è già stata integrata.

  • #836 di @seriouslysean — integrata

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
20/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
python
Ambito
api, backend

Direzione di ricerca

Read _normalize_href, _post_multiget(), normalise_path() and _href_to_url() to trace how listed hrefs are decoded and quoted. Start with the %252F examples in the report and compare search, children, sync and multiget behavior. Done means listed hrefs for UIDs containing / resolve to the same object without losing path components; PR #836 is already open with a fix and tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Setup: iCloud, caldav 3.5.0 and 3.6.0. The events were saved by the iOS Calendar app from invitations (a dental booking site and an Epic MyChart portal).

iCloud names an object whose UID holds a / with the slash as %2F, percent-encoded on top, so the href has %252F (the name _quote_uid() mints too, #143). A GET on the listed href works. Values scrubbed, shapes unchanged:

UID href listed
https://www.example.com/appointments/abc/?token=xyz /cal/home/https%3A%252F%252Fwww.example.com%252Fappointments%252Fabc%252F%3Ftoken%3Dxyz.ics
A7CzVJ5v/[email protected] /cal/home/A7CzVJ5v%252FbTJo0Ebqoj2LQ%3D%3D%40mychart.example.org.ics

_normalize_href decodes the href, and then it gets decoded a second time:

  • In the #435 branch: the decoded first href holds a :, so it's parsed as a URL and its path decoded again. search(), children() and sync return /cal/home/https://www.example.com/appointments/abc/. Any absolute href is decoded twice the same way.
  • In _post_multiget(), whose normalise_path() is quote(unquote(path)): multiget() returns the second object as /cal/home/A7CzVJ5v/bTJo0Ebqoj2LQ%3D%[email protected], which doesn't exist. With url.encode-at.identity declared, requote_path() does the same in _href_to_url() and children().

I'd expect the same for any object saved by this library with a / in its UID, since _quote_uid() mints the same names (not run against the test servers). The ha-test%2Fslash plus%20uid.ics object in #826 looks like the same shape. #783 and #826 are about UID lookups; this is about the hrefs a server lists.

#836 decides absolute vs path on the raw href (RFC 4918 section 8.3) and quotes the decoded href without decoding it again.

AI usage: Claude Code imported my calendar events, debugged the failure, paired with me on the fix and wrote this report. The reproduction was run with caldav 3.5.0; Claude also saw the first case live against iCloud with 3.6.0, and the code is the same in 3.6.0 and master.

While I used AI to do a lot of the work here, this was found while solving a real problem I encountered while importing my own calendar as read-only events for an on-prem agent. This package made it much easier to accomplish that. I've put up a PR to fix it (#836), and have patched it locally to ensure it works and is well tested.

Lingua principale
Python
Stelle
412
Fork
113
Merge medio
10h 34m
PR unite (30g)
75

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di python-caldav/caldav

Tutte le issue di python-caldav/caldav

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.