Skip to content

storage3: object paths containing ? are silently truncated #1640

Description

@rmnvg

Bug

relative_path_to_parts parses the object path with yarl.URL, so ? starts a query string and # starts a fragment. Everything after it is dropped, and the request goes to the wrong object key without any error.

? is a valid character in Supabase Storage object keys (VALID_OBJECT_KEY in supabase/storage src/storage/limits.ts).

Reproduce

bucket = client.storage.from_("bucket")
bucket.upload("folder/what?.png", b"hello")
# request: PUT/POST .../object/bucket/folder/what   <- file saved as "folder/what"

bucket.get_public_url("what?.png")
# .../object/public/bucket/what                     <- wrong URL

Every method that uses relative_path_to_parts is affected: upload, update, download, info, exists, get_public_url, create_signed_url, create_signed_upload_url and upload_to_signed_url.

Expected

The path is kept as-is and ? is sent percent-encoded (what%3F.png), matching supabase-js's encodeStoragePath.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FDBK: BugGitHubbugSomething isn't workingpythonPull requests that update Python codestorageIssues related to storage-py

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions