3 Commits

Author SHA1 Message Date
shoko
ca13a2e194 Merge branch 'pr-34' (URL encoding) into 0.0.3-draft 2026-03-27 02:26:41 +00:00
shoko
3016d1287c test(polymarket-browse): add URL encoding unit tests
Add TestUrlEncoding class testing quote() encodes:
- Space -> %20
- & -> %26
- = -> %3D
- % -> %25
- + -> %2B
- ( -> %28
- ) -> %29
- # -> %23
2026-03-27 01:14:45 +00:00
shoko
bb7eebf502 security(polymarket-browse): use proper URL encoding for --search parameter
- Import quote from urllib.parse
- Replace q.replace(' ', '%20') with quote(q, safe='')
- Properly encodes: &, =, %, +, #, ?, and other special chars
- Prevents URL injection attacks
2026-03-26 19:11:59 +00:00
2 changed files with 22 additions and 2 deletions

View File

@@ -14,7 +14,7 @@ import os
from concurrent.futures import ThreadPoolExecutor, as_completed
from datetime import datetime, timezone, timedelta
from typing import Any, Callable, TypedDict
from urllib.parse import urlencode
from urllib.parse import urlencode, quote
from urllib.request import urlopen, Request
@@ -206,7 +206,7 @@ def fetch_page(
) -> dict[str, Any] | None:
base = "https://gamma-api.polymarket.com/public-search"
url = (
f"{base}?q={q.replace(' ', '%20')}&limit={PAGE_SIZE}&page={page}"
f"{base}?q={quote(q, safe='')}&limit={PAGE_SIZE}&page={page}"
f"&search_profiles=false&search_tags=false"
f"&keep_closed_markets=0&events_status=active&cache=false"
)

View File

@@ -1969,5 +1969,25 @@ class TestTimezoneParsing(unittest.TestCase):
self.assertEqual(tz, timezone(timedelta(hours=7)))
class TestUrlEncoding(unittest.TestCase):
"""Tests for proper URL encoding of search queries."""
def test_quote_encodes_special_chars(self):
"""quote() should properly encode all special characters."""
from urllib.parse import quote
test_cases = [
("Team A", "Team%20A"),
("Team A & Team B", "Team%20A%20%26%20Team%20B"),
("a=b", "a%3Db"),
("100%", "100%25"),
("C++", "C%2B%2B"),
("Team (A)", "Team%20%28A%29"),
("Team#1", "Team%231"),
]
for input_str, expected in test_cases:
self.assertEqual(quote(input_str, safe=""), expected)
if __name__ == "__main__":
unittest.main()