Normalize and safely encode FreshRSS categories - #21
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fd527cff7e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| stream_id = f"user/-/label/{category_label}" if category_label else "user/-/state/com.google/reading-list" | ||
| category_label = category.strip() if isinstance(category, str) else None | ||
| stream_id = ( | ||
| f"user/-/label/{quote(category_label, safe='')}" |
There was a problem hiding this comment.
When the normalized category is . or .., quote(..., safe='') leaves it unchanged because dots are always URL-safe. The locked Requests 2.33.1 then resolves these as path segments while preparing the request: label/. becomes label/, and label/.. becomes user/-/, so FreshRSS receives a different stream ID rather than the requested category. Reject these labels or construct the request so their path segment cannot be normalized; the mocked requests.get tests currently inspect the URL before this preparation occurs.
Useful? React with 👍 / 👎.
|
Superseded by #25 — all four PRs merged with conflict resolution and review fixes applied. |
1 participant
Motivation
categoryquery values are canonicalized so user-supplied whitespace does not produce invalid or surprising upstream requests.categoryvalues as if no category was provided, falling back to the reading list stream.Description
from urllib.parse import quoteand usequote(category_label, safe="")to encode the category as one URL path segment before building the upstream stream path.categoryparameter withcategory.strip()and treat non-string or empty/whitespace results as no category.Queryforcategorywithmax_length=200to impose a reasonable query-string length limit.tests/test_main.py(test_freshrss_unread_normalizes_and_encodes_category) that assert the exact upstream URL for categories containing spaces, slashes, percent signs, question marks, Unicode, and whitespace-only inputs.Testing
uv run pytest -q, and all tests passed (15 passed).Codex Task