3 Commits

Author SHA1 Message Date
shoko
ca13a2e194 Merge branch 'pr-34' (URL encoding) into 0.0.3-draft 2026-03-27 02:26:41 +00:00
shoko
3016d1287c test(polymarket-browse): add URL encoding unit tests
Add TestUrlEncoding class testing quote() encodes:
- Space -> %20
- & -> %26
- = -> %3D
- % -> %25
- + -> %2B
- ( -> %28
- ) -> %29
- # -> %23
2026-03-27 01:14:45 +00:00
shoko
bb7eebf502 security(polymarket-browse): use proper URL encoding for --search parameter
- Import quote from urllib.parse
- Replace q.replace(' ', '%20') with quote(q, safe='')
- Properly encodes: &, =, %, +, #, ?, and other special chars
- Prevents URL injection attacks
2026-03-26 19:11:59 +00:00
2 changed files with 22 additions and 2 deletions

View File

@@ -14,7 +14,7 @@ import os
from concurrent.futures import ThreadPoolExecutor, as_completed from concurrent.futures import ThreadPoolExecutor, as_completed
from datetime import datetime, timezone, timedelta from datetime import datetime, timezone, timedelta
from typing import Any, Callable, TypedDict from typing import Any, Callable, TypedDict
from urllib.parse import urlencode from urllib.parse import urlencode, quote
from urllib.request import urlopen, Request from urllib.request import urlopen, Request
@@ -206,7 +206,7 @@ def fetch_page(
) -> dict[str, Any] | None: ) -> dict[str, Any] | None:
base = "https://gamma-api.polymarket.com/public-search" base = "https://gamma-api.polymarket.com/public-search"
url = ( url = (
f"{base}?q={q.replace(' ', '%20')}&limit={PAGE_SIZE}&page={page}" f"{base}?q={quote(q, safe='')}&limit={PAGE_SIZE}&page={page}"
f"&search_profiles=false&search_tags=false" f"&search_profiles=false&search_tags=false"
f"&keep_closed_markets=0&events_status=active&cache=false" f"&keep_closed_markets=0&events_status=active&cache=false"
) )

View File

@@ -1969,5 +1969,25 @@ class TestTimezoneParsing(unittest.TestCase):
self.assertEqual(tz, timezone(timedelta(hours=7))) self.assertEqual(tz, timezone(timedelta(hours=7)))
class TestUrlEncoding(unittest.TestCase):
"""Tests for proper URL encoding of search queries."""
def test_quote_encodes_special_chars(self):
"""quote() should properly encode all special characters."""
from urllib.parse import quote
test_cases = [
("Team A", "Team%20A"),
("Team A & Team B", "Team%20A%20%26%20Team%20B"),
("a=b", "a%3Db"),
("100%", "100%25"),
("C++", "C%2B%2B"),
("Team (A)", "Team%20%28A%29"),
("Team#1", "Team%231"),
]
for input_str, expected in test_cases:
self.assertEqual(quote(input_str, safe=""), expected)
if __name__ == "__main__": if __name__ == "__main__":
unittest.main() unittest.main()