From cd485065c5d3b024d034a9b6c7ce06f830d0f6b9 2013-10-18 23:13:53
From: MinRK <benjaminrk@gmail.com>
Date: 2013-10-18 23:13:53
Subject: [PATCH] escape URLs in Location headers

---

diff --git a/IPython/html/services/kernels/handlers.py b/IPython/html/services/kernels/handlers.py
index c104207..5c73876 100644
--- a/IPython/html/services/kernels/handlers.py
+++ b/IPython/html/services/kernels/handlers.py
@@ -22,7 +22,7 @@ from tornado import web
 from zmq.utils import jsonapi
 
 from IPython.utils.jsonutil import date_default
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 
 from ...base.handlers import IPythonHandler, json_errors
 from ...base.zmqhandlers import AuthenticatedZMQStreamHandler
@@ -47,7 +47,7 @@ class MainKernelHandler(IPythonHandler):
         kernel_id = km.start_kernel()
         model = km.kernel_model(kernel_id, self.ws_url)
         location = url_path_join(self.base_kernel_url, 'api', 'kernels', kernel_id)
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(jsonapi.dumps(model))
 
diff --git a/IPython/html/services/notebooks/handlers.py b/IPython/html/services/notebooks/handlers.py
index 68f70e3..adcd852 100644
--- a/IPython/html/services/notebooks/handlers.py
+++ b/IPython/html/services/notebooks/handlers.py
@@ -20,7 +20,7 @@ import json
 
 from tornado import web
 
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 from IPython.utils.jsonutil import date_default
 
 from IPython.html.base.handlers import IPythonHandler, json_errors
@@ -44,7 +44,9 @@ class NotebookHandler(IPythonHandler):
         path : unicode
             The URL path of the notebook.
         """
-        return url_path_join(self.base_project_url, 'api', 'notebooks', path, name)
+        return url_escape(url_path_join(
+            self.base_project_url, 'api', 'notebooks', path, name
+        ))
 
     def _finish_model(self, model, location=True):
         """Finish a JSON request with a model, setting relevant headers, etc."""
@@ -222,7 +224,7 @@ class NotebookCheckpointsHandler(IPythonHandler):
         data = json.dumps(checkpoint, default=date_default)
         location = url_path_join(self.base_project_url, 'api/notebooks',
             path, name, 'checkpoints', checkpoint['id'])
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(data)
 
diff --git a/IPython/html/services/notebooks/tests/test_notebooks_api.py b/IPython/html/services/notebooks/tests/test_notebooks_api.py
index 555f5b9..16aefa8 100644
--- a/IPython/html/services/notebooks/tests/test_notebooks_api.py
+++ b/IPython/html/services/notebooks/tests/test_notebooks_api.py
@@ -12,7 +12,7 @@ pjoin = os.path.join
 
 import requests
 
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 from IPython.html.tests.launchnotebook import NotebookTestBase, assert_http_error
 from IPython.nbformat.current import (new_notebook, write, read, new_worksheet,
                                       new_heading_cell, to_notebook_json)
@@ -164,7 +164,7 @@ class APITest(NotebookTestBase):
     def _check_nb_created(self, resp, name, path):
         self.assertEqual(resp.status_code, 201)
         location_header = py3compat.str_to_unicode(resp.headers['Location'])
-        self.assertEqual(location_header.split('/')[-1], name)
+        self.assertEqual(location_header, url_escape(url_path_join(u'/api/notebooks', path, name)))
         self.assertEqual(resp.json()['name'], name)
         assert os.path.isfile(pjoin(self.notebook_dir.name, path, name))
 
@@ -185,7 +185,7 @@ class APITest(NotebookTestBase):
         nbmodel = {'content': nb}
         resp = self.nb_api.upload_untitled(path=u'å b',
                                               body=jsonapi.dumps(nbmodel))
-        self._check_nb_created(resp, 'Untitled0.ipynb', 'å b')
+        self._check_nb_created(resp, 'Untitled0.ipynb', u'å b')
 
     def test_upload(self):
         nb = new_notebook(name=u'ignored')
diff --git a/IPython/html/services/sessions/handlers.py b/IPython/html/services/sessions/handlers.py
index cb8a084..5f8c139 100644
--- a/IPython/html/services/sessions/handlers.py
+++ b/IPython/html/services/sessions/handlers.py
@@ -22,7 +22,7 @@ from tornado import web
 
 from ...base.handlers import IPythonHandler, json_errors
 from IPython.utils.jsonutil import date_default
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 
 #-----------------------------------------------------------------------------
 # Session web service handlers
@@ -65,7 +65,7 @@ class SessionRootHandler(IPythonHandler):
             kernel_id = km.start_kernel(cwd=nbm.notebook_dir)
             model = sm.create_session(name=name, path=path, kernel_id=kernel_id, ws_url=self.ws_url)
         location = url_path_join(self.base_kernel_url, 'api', 'sessions', model['id'])
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(json.dumps(model, default=date_default))