From 267cba648b563a44b41f042798f47a17b5d720dd Mon Sep 17 00:00:00 2001 From: "shuwen.wu" Date: Wed, 2 Sep 2026 17:10:39 +0800 Subject: [PATCH 1/2] fix(storage-blob): normalize backslash to forward slash in SAS canonical resource --- .../azure/storage/blob/_shared_access_signature.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py index 46cb94f9c886..fcb8b3012279 100644 --- a/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py +++ b/sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py @@ -351,6 +351,10 @@ def add_resource_signature( if path[0] != "/": path = "/" + path + # Normalize backslashes to forward slashes to match Azure Storage service behavior + # Go and .NET SDKs already perform this normalization + path = path.replace("\\", "/") + canonicalized_resource = "/blob/" + account_name + path + "\n" # Form the string to sign from shared_access_policy and canonicalized From d42de0ceb2a6b2e1662b1383b4e6c773f0e86042 Mon Sep 17 00:00:00 2001 From: dajiaohuang Date: Fri, 4 Sep 2026 14:11:11 +0800 Subject: [PATCH 2/2] test: cover SAS backslash normalization --- .../tests/test_shared_access_signature.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py diff --git a/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py b/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py new file mode 100644 index 000000000000..9c2fe73f053b --- /dev/null +++ b/sdk/storage/azure-storage-blob/tests/test_shared_access_signature.py @@ -0,0 +1,19 @@ +from datetime import datetime, timedelta + +from azure.storage.blob import BlobSasPermissions, generate_blob_sas + + +def test_generate_blob_sas_normalizes_backslashes_in_canonical_resource(): + string_to_sign = [] + + generate_blob_sas( + account_name="account", + container_name="container", + blob_name="dir\\file", + account_key="a2V5", + permission=BlobSasPermissions(read=True), + expiry=datetime.utcnow() + timedelta(hours=1), + sts_hook=string_to_sign.append, + ) + + assert "/blob/account/container/dir/file\n" in string_to_sign[0]