urwid / urwid / 29938032330 / 4

73%

master: 73%

push

travis-pro

Fix web display broken by token_urlsafe session ids (#1195)

The "more complex identifiers" change switched session id generation to
`secrets.token_urlsafe(16)`, but two spots were not updated to match, so
every keyboard-input / polling request to the web display is rejected:

1. `handle_short_request()` still validated the client-supplied id against
   `len <= 20` and a digits-only charset, while `token_urlsafe(16)` returns
   a 22-char URL-safe base64 string. Legitimate ids were answered with
   `414 URI Too Long` / `403 Forbidden`. The validator now accepts the
   URL-safe base64 alphabet (which is filesystem-safe, so path-traversal is
   still rejected) with a generous length bound.

2. The pipe name is created as `urwid_{id}` but the request handler opened
   `urwid{id}` (missing underscore), so even a valid id resulted in
   `404 Not Found`. The handler now uses the same `urwid_{id}` prefix.

Co-authored-by: zeyouliu <zeyouliu@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

1891 of 2499 branches covered (75.67%)

Branch coverage included in aggregate %.

8439 of 11682 relevant lines covered (72.24%)

0.72 hits per line