← eval4_submission

fastapi_14786

resolved RESOLVED PASS · 8 tool calls · 44 s · fastapi/fastapi

Task input

🐛 Strip whitespaces from `Authorization` header credentials

## Description

Fixes whitespace handling in authorization header parameter extraction to comply with [RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750#section-2.1).

## Problem

The current implementation preserves leading/trailing whitespace in the extracted credential parameter. While RFC 6750 allows one or more spaces (`1*SP`) between "Bearer" and the token, the token definition (`b64token`) doesn't include whitespace characters, meaning spaces should be treated as separators only.

This causes the extracted credentials to include extraneous whitespace, which can lead to authentication failures.

## Solution

Added `.strip()` to the parameter extraction to remove leading and trailing whitespace:
```python
return scheme, param.strip()
```

## Reproduction

### Before the fix:
```python
from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

app = FastAPI()
security = HTTPBearer()

@app.get("/users/me")
def read_current_user(
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(security)]
):
    return {"scheme": credentials.scheme, "credentials": credentials.credentials}
```

**Test case 1: Single space (correct)**
```bash
curl -X 'GET' \
  'http://127.0.0.1:8000/users/me' \
  -H 'Authorization: Bearer xxx'
```
Response: `{"scheme":"Bearer","credentials":"xxx"}` ✓

**Test case 2: Multiple spaces**
```bash
curl -X 'GET' \
  'http://127.0.0.1:8000/users/me' \
  -H 'Authorization: Bearer   xxx'
```
Response: `{"scheme":"Bearer","credentials":"  xxx"}` ✗

**Test case 3: Trailing whitespace**
```bash
curl -X 'GET' \
  'http://127.0.0.1:8000/users/me' \
  -H 'Authorization: Bearer xxx '
```
Response: `{"scheme":"Bearer","credentials":"xxx "}` ✗

### After the fix:

All three test cases now return: `{"scheme":"Bearer","credentials":"xxx"}` ✓

## Changes

- Modified `get_authorization_scheme_param()` in `fastapi/security/utils.py` to strip whitespace from the parameter
- Added test cases to verify the fix handles multiple spaces and trailing whitespace correctly

## Checklist

- [x] Tests added to cover the bug fix
- [x] Existing tests pass

Tool calls (9)

{
 "filepath": "fastapi/security/utils.py"
}

{"status": "ok", "filepath": "fastapi/security/utils.py", "content": "from typing import Optional\n\n\ndef get_authorization_scheme_param(\n    authorization_header_value: Optional[str],\n) -> tuple[str, str]:\n    if not authorization_header_value:\n        return \"\", \"\"\n    scheme, _, param = authorization_header_value.partition(\" \")\n    return scheme, param\n", "start_line": 1, "end_line": 10, "total_lines": 10, "is_truncated": false}

{
 "content": "from fastapi.security.utils import get_authorization_scheme_param\n\ndef test_get_authorization_scheme_param_whitespace():\n    # Single space (correct)\n    assert get_authorization_scheme_param(\"Bearer xxx\") == (\"Bearer\", \"xxx\")\n    \n    # Multiple spaces\n    assert get_authorization_scheme_param(\"Bearer   xxx\") == (\"Bearer\", \"xxx\")\n    \n    # Trailing whitespace\n    assert get_authorization_scheme_param(\"Bearer xxx \") == (\"Bearer\", \"xxx\")\n    \n    # Leading whitespace in param\n    assert get_authorization_scheme_param(\"Bearer  xxx\") == (\"Bearer\", \"xxx\")\n    \n    # No param\n    assert get_authorization_scheme_param(\"Bearer\") == (\"Bearer\", \"\")\n    \n    # Empty header\n    assert get_authorization_scheme_param(None) == (\"\", \"\")\n    assert get_authorization_scheme_param(\"\") == (\"\", \"\")\n\nif __name__ == \"__main__\":\n    test_get_authorization_scheme_param_whitespace()\n    print(\"Tests passed!\")\n",
 "filepath": "/tmp/test_auth_strip.py"
}

{"status": "ok", "filepath": "/tmp/test_auth_strip.py", "size": 899}

{
 "command": "python3 /tmp/test_auth_strip.py"
}

{"status": "error", "error_type": "CommandError", "error_message": "Command failed with exit code 2", "details": {"stdout": "", "stderr": "python3: can't open file '/tmp/swe_work/eval4_submission/fastapi_14786/a/tmp/test_auth_strip.py': [Errno 2] No such file or directory\n", "exit_code": 2}}

{
 "command": "ls -R /tmp"
}

{"status": "ok", "stdout": "/tmp/swe_work/eval4_submission/fastapi_14786/a/tmp:\n", "exit_code": 0}

{
 "command": "python3 -c \"from fastapi.security.utils import get_authorization_scheme_param; assert get_authorization_scheme_param('Bearer   xxx') == ('Bearer', '  xxx')\""
}

{"status": "ok", "stdout": "", "exit_code": 0}

{
 "filepath": "fastapi/security/utils.py",
 "new_string": "    scheme, _, param = authorization_header_value.partition(\" \")\n    return scheme, param.strip()",
 "old_string": "    scheme, _, param = authorization_header_value.partition(\" \")\n    return scheme, param"
}

{"status": "ok", "filepath": "fastapi/security/utils.py", "occurrences": 1, "strategy": "exact", "diff": "--- a/fastapi/security/utils.py\n+++ b/fastapi/security/utils.py\n@@ -7,4 +7,4 @@\n     if not authorization_header_value:\n         return \"\", \"\"\n     scheme, _, param = authorization_header_value.partition(\" \")\n-    return scheme, param\n+    return scheme, param.strip()\n", "is_truncated": false}

{
 "command": "python3 -c \"from fastapi.security.utils import get_authorization_scheme_param; assert get_authorization_scheme_param('Bearer   xxx') == ('Bearer', 'xxx'); assert get_authorization_scheme_param('Bearer xxx ') == ('Bearer', 'xxx'); assert get_authorization_scheme_param('Bearer xxx') == ('Bearer', 'xxx'); print('Tests passed!')\""
}

{"status": "ok", "stdout": "Tests passed!\n", "exit_code": 0}

[]

{"status": "ok", "patch_size": 1495, "files_changed": 2}

Patch

diff --git a/fastapi/security/utils.py b/fastapi/security/utils.py
index 002e68b4..fd349aec 100644
--- a/fastapi/security/utils.py
+++ b/fastapi/security/utils.py
@@ -7,4 +7,4 @@ def get_authorization_scheme_param(
     if not authorization_header_value:
         return "", ""
     scheme, _, param = authorization_header_value.partition(" ")
-    return scheme, param
+    return scheme, param.strip()
diff --git a/tmp/test_auth_strip.py b/tmp/test_auth_strip.py
new file mode 100644
index 00000000..ab0251bb
--- /dev/null
+++ b/tmp/test_auth_strip.py
@@ -0,0 +1,25 @@
+from fastapi.security.utils import get_authorization_scheme_param
+
+def test_get_authorization_scheme_param_whitespace():
+    # Single space (correct)
+    assert get_authorization_scheme_param("Bearer xxx") == ("Bearer", "xxx")
+    
+    # Multiple spaces
+    assert get_authorization_scheme_param("Bearer   xxx") == ("Bearer", "xxx")
+    
+    # Trailing whitespace
+    assert get_authorization_scheme_param("Bearer xxx ") == ("Bearer", "xxx")
+    
+    # Leading whitespace in param
+    assert get_authorization_scheme_param("Bearer  xxx") == ("Bearer", "xxx")
+    
+    # No param
+    assert get_authorization_scheme_param("Bearer") == ("Bearer", "")
+    
+    # Empty header
+    assert get_authorization_scheme_param(None) == ("", "")
+    assert get_authorization_scheme_param("") == ("", "")
+
+if __name__ == "__main__":
+    test_get_authorization_scheme_param_whitespace()
+    print("Tests passed!")

Test output

.........                                                                [100%]
=============================== warnings summary ===============================
../../../../../../kaggle/tmp/envs/overlays/starlette-0.50.0-py3-none-any/starlette/testclient.py:45
  /kaggle/tmp/envs/overlays/starlette-0.50.0-py3-none-any/starlette/testclient.py:45: DeprecationWarning: The anyio.abc.BlockingPortal alias is deprecated, use anyio.from_thread.BlockingPortal instead.
    _PortalFactoryType = Callable[[], AbstractContextManager[anyio.abc.BlockingPortal]]

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
9 passed, 1 warning in 0.71s