Skip to content

FEAT: Add configurable safe parameter to UrlConverter - #3402

Open
Vardhman Gupta (Kaap10) wants to merge 1 commit into
microsoft:mainfrom
Kaap10:fix/url-converter-safe-parameter
Open

Vardhman Gupta (Kaap10) wants to merge 1 commit into
microsoft:mainfrom
Kaap10:fix/url-converter-safe-parameter

Conversation

@Kaap10

Copy link
Copy Markdown
Contributor

Description

Closes #3401

Adds a configurable safe parameter to UrlConverter:

  • Default safe="": Enforces complete URL encoding of reserved characters by default, including forward slashes (/ -> %2F), ensuring path traversal (../../etc/passwd) and SSRF payloads are properly encoded for evasion testing.
  • Custom safe Support: Callers wishing to preserve specific characters (such as / or /:) can configure UrlConverter(safe="/") or any custom string.
  • Identifiable & Serialization: Overrides _build_identifier() to serialize params={"safe": self._safe}, adhering to the converter contract.
  • Input Validation: Validates that safe is a string, raising TypeError otherwise.

Tests and Documentation

  • Added test_url_converter_default_encodes_forward_slash verifying that path traversal and SSRF payloads have slashes encoded as %2F by default.
  • Added test_url_converter_custom_safe testing safe="/", safe="/:", and query formatting safe="?=".
  • Added test_url_converter_property_and_identifier testing the property and identifier parameter serialization.
  • Added test_url_converter_invalid_safe_type verifying TypeError on invalid arguments.
  • Added test_url_converter_reconstruction verifying reconstruction parameters.
  • Ran converter unit tests and contracts: all 192 tests pass; ruff check and format pass.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BUG: UrlConverter preserves forward slashes by default, preventing path payload evasion

1 participant