[Storage] Fixed SAS generation for blob names with a backslash - #48883
Open
anjaliratnam-msft wants to merge 3 commits into
Open
[Storage] Fixed SAS generation for blob names with a backslash#48883anjaliratnam-msft wants to merge 3 commits into
anjaliratnam-msft wants to merge 3 commits into
Conversation
anjaliratnam-msft
requested review from
Jacob Lauzon (jalauzon-msft),
vincenttran-msft and
Peter Wu (weirongw23-msft)
as code owners
September 3, 2026 15:27
|
Azure Pipelines: Successfully started running 1 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused implementation consistently matches service canonicalization and includes coverage across all affected Storage packages.
Pull request overview
Fixes SAS authentication for Storage resource names containing backslashes by matching service-side canonicalization.
Changes:
- Normalizes backslashes in Blob and File Share SAS resource paths.
- Corrects Data Lake signed-directory depth calculation.
- Adds live regression tests and changelog entries.
File summaries
| File | Description |
|---|---|
sdk/storage/azure-storage-file-share/tests/test_file.py |
Tests SAS access for backslash file paths. |
sdk/storage/azure-storage-file-share/CHANGELOG.md |
Documents the fix. |
sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared_access_signature.py |
Canonicalizes file resource paths. |
sdk/storage/azure-storage-file-datalake/tests/test_directory.py |
Tests directory SAS canonicalization and depth. |
sdk/storage/azure-storage-file-datalake/CHANGELOG.md |
Documents the fix. |
sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared_access_signature.py |
Calculates depth from the canonicalized path. |
sdk/storage/azure-storage-blob/tests/test_common_blob.py |
Tests SAS access for backslash blob names. |
sdk/storage/azure-storage-blob/CHANGELOG.md |
Documents the fix. |
sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py |
Canonicalizes blob names before signing. |
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Data Lake SAS generation calculates an incorrect directory depth when a backslash canonicalizes to the root path.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 9/9 changed files
- Comments generated: 1
- Review effort level: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A SAS generated for a blob/path/file name containing a backslash (
\) is always rejected with403 AuthenticationFailed. The service canonicalizes\to/when it rebuilds the signed resource to validate the signature, but the SDK signs the name verbatim. The two strings differ, so the signatures never match. Backslashes are valid in flat blob names and in HNS paths, and the Files service treats\as a path separator, so this is reachable in all three services. This resolves #48690.Fix
Normalize
\to/when building the signed resource:blob_nameingenerate_blob, before it is used for both the signed resource and the signed directory depth (sdd).generate_directory_sascomputessdditself and passes it explicitly, overriding the blob value, so the depth is now computed from the canonicalized name.resource_pathingenerate_file.Testing
Added one live test per package that creates a resource with a backslash in the name, generates a SAS for it, and reads through that SAS.