SNOW-1463842 (#1967)

Author: sfc-gh-jdu

DESCRIPTION.md

@@ -16,6 +16,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Fixed a bug that OCSP certificate signed using SHA384 algorithm cannot be verified.
   - Fixed a bug that status code shown as uploaded when PUT command failed with 400 error.
   - Fixed a bug that a PermissionError was raised when the current user does not have the right permission on parent directory of config file path.
+  - Fixed a bug that OCSP GET url is not encoded correctly when it contains a slash.
 
 - v3.10.1(May 21, 2024)
 

src/snowflake/connector/ocsp_snowflake.py

@@ -62,6 +62,7 @@
 from .backoff_policies import exponential_backoff
 from .cache import SFDictCache, SFDictFileCache
 from .telemetry import TelemetryField, generate_telemetry_data_dict
+from .url_util import url_encode_str
 
 
 class OCSPResponseValidationResult(NamedTuple):
@@ -436,8 +437,9 @@ def _download_ocsp_response_cache(ocsp, url, do_retry: bool = True) -> bool:
 
     def generate_get_url(self, ocsp_url, b64data):
         parsed_url = urlsplit(ocsp_url)
+        url_encoded_b64data = url_encode_str(b64data)
         if self.OCSP_RETRY_URL is None:
-            target_url = f"{ocsp_url}/{b64data}"
+            target_url = f"{ocsp_url}/{url_encoded_b64data}"
         else:
             # values of parsed_url.netloc and parsed_url.path based on oscp_url are as follows:
             # URL                                    NETLOC                         PATH
@@ -447,7 +449,9 @@ def generate_get_url(self, ocsp_url, b64data):
             # "http://oneocsp.microsoft.com/ocsp"    "oneocsp.microsoft.com"        "/ocsp"
             # The check below is to treat first two urls same
             path = parsed_url.path if parsed_url.path != "/" else ""
-            target_url = self.OCSP_RETRY_URL.format(parsed_url.netloc + path, b64data)
+            target_url = self.OCSP_RETRY_URL.format(
+                parsed_url.netloc + path, url_encoded_b64data
+            )
 
         logger.debug("OCSP Retry URL is - %s", target_url)
         return target_url

test/unit/test_ocsp.py

@@ -485,6 +485,14 @@ def test_building_retry_url():
         == "http://ocsp.us-east-1.snowflakecomputing.com/retry/oneocsp.microsoft.com:8080/ocsp/1234"
     )
 
+    # ensure we handle slash correctly
+    assert (
+        OCSP_SERVER.generate_get_url(
+            "http://oneocsp.microsoft.com:8080/ocsp", "aa//bb/"
+        )
+        == "http://ocsp.us-east-1.snowflakecomputing.com/retry/oneocsp.microsoft.com:8080/ocsp/aa%2F%2Fbb%2F"
+    )
+
     # privatelink retry url with port
     OCSP_SERVER.OCSP_RETRY_URL = None
     OCSP_SERVER.CACHE_SERVER_URL = (