Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/requests/auth.py
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,8 @@ def sha512_utf8(x):
p_parsed = urlparse(url)
#: path is request-uri defined in RFC 2616 which should not be empty
path = p_parsed.path or "/"
if p_parsed.params:
path += f";{p_parsed.params}"
if p_parsed.query:
path += f"?{p_parsed.query}"

Expand Down
39 changes: 39 additions & 0 deletions tests/test_requests.py
Original file line number Diff line number Diff line change
Expand Up @@ -805,6 +805,45 @@ def test_DIGESTAUTH_QUOTES_QOP_VALUE(self, httpbin):
r = requests.get(url, auth=auth)
assert '"auth"' in r.request.headers["Authorization"]

def test_DIGESTAUTH_WITH_SEMICOLONS_IN_PATH(self):
"""Test that digest auth correctly includes semicolons in the uri field.

This tests issue #6990 where semicolons in URL paths were being
truncated in the digest auth uri field.
"""
from unittest.mock import Mock, patch

auth = HTTPDigestAuth("user", "pass")

# Initialize the auth state
auth.init_per_thread_state()
auth._thread_local.chal = {
"realm": "test-realm",
"nonce": "test-nonce",
"qop": "auth",
"algorithm": "MD5"
}
auth._thread_local.last_nonce = ""

# Test URL with semicolons in the path (MusicBrainz-style API)
test_url = "https://example.com/api/collection/id1/releases/uuid1;uuid2;uuid3?fmt=json&client=test"

# Build the digest header
header = auth.build_digest_header("PUT", test_url)

# Extract the uri field from the Authorization header
assert 'uri="/api/collection/id1/releases/uuid1;uuid2;uuid3?fmt=json&client=test"' in header

# Test with semicolons but no query parameters
test_url2 = "https://example.com/path/id1;id2;id3"
header2 = auth.build_digest_header("GET", test_url2)
assert 'uri="/path/id1;id2;id3"' in header2

# Test with just path (no semicolons or query)
test_url3 = "https://example.com/simple/path"
header3 = auth.build_digest_header("GET", test_url3)
assert 'uri="/simple/path"' in header3

def test_POSTBIN_GET_POST_FILES(self, httpbin):
url = httpbin("post")
requests.post(url).raise_for_status()
Expand Down