Skip to content

Conversation

@veeceey
Copy link

@veeceey veeceey commented Feb 8, 2026

Summary

  • Fixes the uri field in HTTP Digest Authentication being incorrectly truncated when the URL path contains semicolons
  • Replaces urlparse with urlsplit in build_digest_header() since urlparse treats semicolons as parameter separators (stripping everything after the first ; from the path), while urlsplit correctly preserves them

Fixes #6990

Explanation

Python's urlparse splits the path on ; and moves the content after it to a params attribute:

>>> from urllib.parse import urlparse
>>> urlparse("https://example.com/a;b?q=1")
ParseResult(scheme='https', netloc='example.com', path='/a', params='b', query='q=1', fragment='')

urlsplit does not have this behavior and keeps the full path intact:

>>> from urllib.parse import urlsplit
>>> urlsplit("https://example.com/a;b?q=1")
SplitResult(scheme='https', netloc='example.com', path='/a;b', query='q=1', fragment='')

Since only path and query are used from the parsed result (not params), urlsplit is a safe drop-in replacement that correctly preserves the full request URI as required by RFC 7616.

Test plan

  • Verified the fix with the exact reproduction case from the issue (MusicBrainz URL with semicolons as separators)
  • All existing non-httpbin tests pass

urlparse treats semicolons as parameter separators, which strips
everything after the first semicolon in the URL path from the
digest auth `uri` field. urlsplit does not have this behavior and
correctly preserves semicolons in the path.

Fixes psf#6990
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uri field of digest authentication incorrectly filled when the URL contains semicolons in path

1 participant