diff --git a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py index 46cb94f9c886..fcb8b3012279 100644 --- a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py +++ b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py @@ -351,6 +351,10 @@ def add_resource_signature( if path[0] != "/": path = "/" + path + # Normalize backslashes to forward slashes to match Azure Storage service behavior + # Go and .NET SDKs already perform this normalization + path = path.replace("\\", "/") + canonicalized_resource = "/blob/" + account_name + path + "\n" # Form the string to sign from shared_access_policy and canonicalized diff --git a/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py b/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py new file mode 100644 index 000000000000..9c2fe73f053b --- /dev/null +++ b/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py @@ -0,0 +1,19 @@ +from datetime import datetime, timedelta + +from azure.storage.blob import BlobSasPermissions, generate_blob_sas + + +def test_generate_blob_sas_normalizes_backslashes_in_canonical_resource(): + string_to_sign = [] + + generate_blob_sas( + account_name="account", + container_name="container", + blob_name="dir\\file", + account_key="a2V5", + permission=BlobSasPermissions(read=True), + expiry=datetime.utcnow() + timedelta(hours=1), + sts_hook=string_to_sign.append, + ) + + assert "/blob/account/container/dir/file\n" in string_to_sign[0]