Skip to content

fix(runtime): escape single quotes once in OData string literals - #1053

Merged
vgrem merged 1 commit into
vgrem:masterfrom
WynandVStaden:fix/odata-single-quote-double-escape
Oct 5, 2026
Merged

vgrem merged 1 commit into
vgrem:masterfrom
WynandVStaden:fix/odata-single-quote-double-escape

Conversation

@WynandVStaden

Copy link
Copy Markdown
Contributor

Summary

Fixes #1052.

ODataPathBuilder._encode_string escaped a single quote twice: once with an explicit value.replace("'", "''") and again through the _SPECIAL_CHARS table, which also maps ' to ''. As a result d'appello was encoded as 'd''''appello' instead of 'd''appello', so any SharePoint path or name containing an apostrophe pointed at the wrong resource, for example:

/Web/getFileByServerRelativePath(DecodedUrl='/sites/x/Shared Documents/d''''appello.docx')

The change removes the explicit replace and leaves the quote to the table. The reporter saw it on Windows only, but the code path is not platform specific; I reproduced it on current master.

Type of change

  • Bug fix
  • New feature
  • Documentation / examples
  • Refactor / internal

Checklist

  • uv run ruff check . passes. ruff format --check passes for the two changed Python files; I did not rely on the repo-wide run because my Windows checkout has CRLF working copies, which makes it report every file.
  • uv run pyright is clean (0 errors)
  • uv run pytest --offline -q passes (823 passed, 986 skipped; 820 passed before the new tests)
  • uv run mkdocs build --strict passes (no docs or examples changed, not run)
  • Added/updated tests under tests/unit where practical
  • Linked the related issue

Tests

Three tests added to tests/unit/test_runtime_paths.py. The two quote tests fail on master and pass with the fix; the third pins the existing behaviour that %, +, &, #, ? and * are each encoded once, so the replacement text is not re-encoded.

ODataPathBuilder._encode_string doubled each single quote explicitly and
then again through the _SPECIAL_CHARS table, so "d'appello" was encoded
as 'd''''appello' instead of 'd''appello'. Paths and names containing an
apostrophe therefore resolved to the wrong resource.

Drop the explicit replace and let the table handle the quote, and add unit
tests for quote and special-character escaping.

Fixes vgrem#1052
@vgrem
vgrem merged commit 6761366 into vgrem:master Oct 5, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: issue with office365.runtime.paths.builder

2 participants