fix: ensure URI quoting of resource path

tseaver · tseaver · commit 6cc5f8ab72a1 · 2020-02-12T14:47:45.000-05:00
diff --git a/google/cloud/storage/_signing.py b/google/cloud/storage/_signing.py
@@ -586,9 +586,11 @@ def generate_signed_url_v4(
     ordered_query_parameters = sorted(query_parameters.items())
     canonical_query_string = six.moves.urllib.parse.urlencode(ordered_query_parameters)
 
+    quoted_resource = six.moves.urllib.parse.quote(resource)
+
     canonical_elements = [
         method,
-        resource,
+        quoted_resource,
         canonical_query_string,
         canonical_header_string,
         signed_headers,
@@ -617,7 +619,7 @@ def generate_signed_url_v4(
         signature = binascii.hexlify(signature_bytes).decode("ascii")
 
     return "{}{}?{}&X-Goog-Signature={}".format(
-        api_access_endpoint, resource, canonical_query_string, signature
+        api_access_endpoint, quoted_resource, canonical_query_string, signature
     )
 
 
diff --git a/tests/unit/test__signing.py b/tests/unit/test__signing.py
@@ -544,9 +544,9 @@ def _generate_helper(
         generation=None,
         headers=None,
         query_parameters=None,
+        resource="/name/path",
     ):
         now = datetime.datetime(2019, 2, 26, 19, 53, 27)
-        resource = "/name/path"
         signer_email = "service@example.com"
         credentials = _make_credentials(signer_email=signer_email)
         credentials.sign_bytes.return_value = b"DEADBEEF"
@@ -577,7 +577,7 @@ def _generate_helper(
         )
         self.assertEqual(scheme, expected_scheme)
         self.assertEqual(netloc, expected_netloc)
-        self.assertEqual(path, resource)
+        self.assertEqual(path, six.moves.urllib.parse.quote(resource))
         self.assertEqual(frag, "")
 
         # Check the URL parameters.
@@ -656,6 +656,9 @@ def test_w_custom_query_parameters_w_string_value(self):
     def test_w_custom_query_parameters_w_none_value(self):
         self._generate_helper(query_parameters={"qux": None})
 
+    def test_w_non_ascii_resource(self):
+        self._generate_helper(resource="/name/p\xe5th")
+
     def test_with_access_token(self):
         resource = "/name/path"
         signer_email = "service@example.com"
