urwid / urwid / 29938032330

73%

Build Type

push

travis-pro

Committed by web-flow

Commit Message

Fix web display broken by token_urlsafe session ids (#1195)

The "more complex identifiers" change switched session id generation to
`secrets.token_urlsafe(16)`, but two spots were not updated to match, so
every keyboard-input / polling request to the web display is rejected:

1. `handle_short_request()` still validated the client-supplied id against
   `len <= 20` and a digits-only charset, while `token_urlsafe(16)` returns
   a 22-char URL-safe base64 string. Legitimate ids were answered with
   `414 URI Too Long` / `403 Forbidden`. The validator now accepts the
   URL-safe base64 alphabet (which is filesystem-safe, so path-traversal is
   still rejected) with a generous length bound.

2. The pipe name is created as `urwid_{id}` but the request handler opened
   `urwid{id}` (missing underscore), so even a valid id resulted in
   `404 Not Found`. The handler now uses the same `urwid_{id}` prefix.

Co-authored-by: zeyouliu <zeyouliu@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Coverage Stats

1941 of 2583 branches covered (75.15%)

Branch coverage included in aggregate %.

0 of 6 new or added lines in 1 file covered. (0.0%)

104 existing lines in 1 file now uncovered.

8519 of 11846 relevant lines covered (71.91%)

7.33 hits per line