request.build_absolute_uri() functions incorrectly when the path starts with //

[anonymous]

A request to:

​http://www.example.com:8080//django-ate-my-baby/

leads to request.build_absolute_uri() returning:

​http://django-ate-my-baby/

[Michael Angeletti]

I've attached the fix, but if it needs improvements, let me know and I'll update the diff ASAP.

[Michael Angeletti]

Pardon my resolving of the ticket.

[Abhaya Agarwal]

Since the original function as well as your patch is using self.path to construct the base_uri, query parameters are not preserved anyway. So branching doesn't serve any purpose.
One simpler way is to strip out the additional slashes in the beginning of self.path in this function. It may be better to do that where the request is initialized.

[Abhaya Agarwal]

Also str.format was introduced in Python 2.6 while Django 1.4 supports Python 2.5 also. So that should be reverted back to old style string interpolation.

[Michael Angeletti]

Replying to abhaga:

Since the original function as well as your patch is using self.path to construct the base_uri, query parameters are not preserved anyway. So branching doesn't serve any purpose.
One simpler way is to strip out the additional slashes in the beginning of self.path in this function. It may be better to do that where the request is initialized.

That is incorrect. location, if provided or not is joined with the base_uri, and when not provided is built using ​request.get_full_path(). This happens in both my patch and the original.

>>> from urlparse import urljoin 
>>> urljoin('http://www.example.com/foo/', 'http://www.example.com/foo/?bar=baz')
'http://www.example.com/foo/?bar=baz'

Regarding the usage of basestring.format(), I'll provide an updated patch which uses string interpolation.

[Michael Angeletti]

Patch to fix bug, updated to remove basestring.format() usage

[Chris Beaven]

Here's a simpler way to do it.

[Michael Angeletti]

Replying to SmileyChris:

Here's a simpler way to do it.

I don't mean to sound too competitive, but I think my patch is as simple as possible, but no simpler :P It only has 2 very simple logical branches, and requires no hacking. I think prepending '//' to self.get_full_path() is a bit hacky, as it simply takes advantage urlsplit setting netloc to '' when a URL starts with // (explicit over implicit comes to mind here).

Also worth noting is:

        if not location: 

Not using is not None here could lead to an unintended result, if ever a bug were to cause this method to be called with an empty string provided as the location argument.

[anonymous]

Any word on which patch will go to master? Both include passing tests for regression, etc., and both provide the exact same result.

[Kamu]

If I am not mistaken the patch requires updating. The test files being patched no longer exist at that location.

[Susan Tan]

The 1st test fails.But the other 3 pass. Can someone also test this patch? Hmm. Well, I'm going to have to fix up the patch.

[Susan Tan]

​https://github.com/django/django/pull/1314 PR is here.

[Unai Zalakain]

Enhanced docs, all test passing plus correct handling of leading slashes by WSGIRequest.
Ups, I forgot to link to the PR: ​https://github.com/django/django/pull/1866

[Tim Graham <timograham@…>]

In 11284a63d48c84f1d60b5686d55cf8a9f8d64422:

Fixed #18314 -- Corrected request.build_absolute_uri() handling of paths starting with

HttpRequest.build_absolute_uri() now correctly handles paths starting with .
WSGIRequest now doesn't remove all the leading slashes either,
because ​http://test/server and ​http://test//server aren't the same thing
(RFC2396).

Thanks to SmileyChris for the initial patch.