escape URLs in Location headers

IPython/html/services/kernels/handlers.py

@@ -22,7 +22,7 b' from tornado import web'
 from zmq.utils import jsonapi
 
 from IPython.utils.jsonutil import date_default
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 
 from ...base.handlers import IPythonHandler, json_errors
 from ...base.zmqhandlers import AuthenticatedZMQStreamHandler
@@ -47,7 +47,7 b' class MainKernelHandler(IPythonHandler):'
         kernel_id = km.start_kernel()
         model = km.kernel_model(kernel_id, self.ws_url)
         location = url_path_join(self.base_kernel_url, 'api', 'kernels', kernel_id)
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(jsonapi.dumps(model))
 

IPython/html/services/notebooks/handlers.py

@@ -20,7 +20,7 b' import json'
 
 from tornado import web
 
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 from IPython.utils.jsonutil import date_default
 
 from IPython.html.base.handlers import IPythonHandler, json_errors
@@ -44,7 +44,9 b' class NotebookHandler(IPythonHandler):'
         path : unicode
             The URL path of the notebook.
         """
-        return url_path_join(self.base_project_url, 'api', 'notebooks', path, name)
+        return url_escape(url_path_join(
+            self.base_project_url, 'api', 'notebooks', path, name
+        ))
 
     def _finish_model(self, model, location=True):
         """Finish a JSON request with a model, setting relevant headers, etc."""
@@ -222,7 +224,7 b' class NotebookCheckpointsHandler(IPythonHandler):'
         data = json.dumps(checkpoint, default=date_default)
         location = url_path_join(self.base_project_url, 'api/notebooks',
             path, name, 'checkpoints', checkpoint['id'])
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(data)
 

IPython/html/services/notebooks/tests/test_notebooks_api.py

@@ -12,7 +12,7 b' pjoin = os.path.join'
 
 import requests
 
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 from IPython.html.tests.launchnotebook import NotebookTestBase, assert_http_error
 from IPython.nbformat.current import (new_notebook, write, read, new_worksheet,
                                       new_heading_cell, to_notebook_json)
@@ -164,7 +164,7 b' class APITest(NotebookTestBase):'
     def _check_nb_created(self, resp, name, path):
         self.assertEqual(resp.status_code, 201)
         location_header = py3compat.str_to_unicode(resp.headers['Location'])
-        self.assertEqual(location_header.split('/')[-1], name)
+        self.assertEqual(location_header, url_escape(url_path_join(u'/api/notebooks', path, name)))
         self.assertEqual(resp.json()['name'], name)
         assert os.path.isfile(pjoin(self.notebook_dir.name, path, name))
 
@@ -185,7 +185,7 b' class APITest(NotebookTestBase):'
         nbmodel = {'content': nb}
         resp = self.nb_api.upload_untitled(path=u'å b',
                                               body=jsonapi.dumps(nbmodel))
-        self._check_nb_created(resp, 'Untitled0.ipynb', 'å b')
+        self._check_nb_created(resp, 'Untitled0.ipynb', u'å b')
 
     def test_upload(self):
         nb = new_notebook(name=u'ignored')

IPython/html/services/sessions/handlers.py

@@ -22,7 +22,7 b' from tornado import web'
 
 from ...base.handlers import IPythonHandler, json_errors
 from IPython.utils.jsonutil import date_default
-from IPython.html.utils import url_path_join
+from IPython.html.utils import url_path_join, url_escape
 
 #-----------------------------------------------------------------------------
 # Session web service handlers
@@ -65,7 +65,7 b' class SessionRootHandler(IPythonHandler):'
             kernel_id = km.start_kernel(cwd=nbm.notebook_dir)
             model = sm.create_session(name=name, path=path, kernel_id=kernel_id, ws_url=self.ws_url)
         location = url_path_join(self.base_kernel_url, 'api', 'sessions', model['id'])
-        self.set_header('Location', location)
+        self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(json.dumps(model, default=date_default))