- ``request.static_url`` now generates URL-quoted URLs when fed a ``path``

  argument which contains characters that are unsuitable for URLs.

3 files changed, 26 insertions, 1 deletions

diff --git a/CHANGES.txt b/CHANGES.txt
index 42f07a275..6e664f077 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -33,6 +33,9 @@ Bug Fixes
 - The DummySession in ``pyramid.testing`` now generates a new CSRF token if
   one doesn't yet exist.
 
+- ``request.static_url`` now generates URL-quoted URLs when fed a ``path``
+  argument which contains characters that are unsuitable for URLs.
+
 Backwards Incompatibilities
 ---------------------------
 
diff --git a/pyramid/config/views.py b/pyramid/config/views.py
index a88c22b12..cf27c3514 100644
--- a/pyramid/config/views.py
+++ b/pyramid/config/views.py
@@ -30,6 +30,7 @@ from pyramid import renderers
 from pyramid.compat import string_types
 from pyramid.compat import urlparse
 from pyramid.compat import im_func
+from pyramid.compat import url_quote
 from pyramid.exceptions import ConfigurationError
 from pyramid.exceptions import PredicateMismatch
 from pyramid.httpexceptions import HTTPForbidden
@@ -1429,7 +1430,7 @@ class StaticURLInfo(object):
             registry = get_current_registry()
         for (url, spec, route_name) in self._get_registrations(registry):
             if path.startswith(spec):
-                subpath = path[len(spec):]
+                subpath = url_quote(path[len(spec):])
                 if url is None:
                     kw['subpath'] = subpath
                     return request.route_url(route_name, **kw)
diff --git a/pyramid/tests/test_config/test_views.py b/pyramid/tests/test_config/test_views.py
index fa263a311..a9a4d5836 100644
--- a/pyramid/tests/test_config/test_views.py
+++ b/pyramid/tests/test_config/test_views.py
@@ -3362,6 +3362,27 @@ class TestStaticURLInfo(unittest.TestCase):
         result = inst.generate('package:path/abc', request, a=1)
         self.assertEqual(result, 'url')
 
+    def test_generate_url_quoted_local(self):
+        inst = self._makeOne()
+        registrations = [(None, 'package:path/', '__viewname/')]
+        inst._get_registrations = lambda *x: registrations
+        def route_url(n, **kw):
+            self.assertEqual(n, '__viewname/')
+            self.assertEqual(kw, {'subpath':'abc%20def', 'a':1})
+            return 'url'
+        request = self._makeRequest()
+        request.route_url = route_url
+        result = inst.generate('package:path/abc def', request, a=1)
+        self.assertEqual(result, 'url')
+
+    def test_generate_url_quoted_remote(self):
+        inst = self._makeOne()
+        registrations = [('http://example.com/', 'package:path/', None)]
+        inst._get_registrations = lambda *x: registrations
+        request = self._makeRequest()
+        result = inst.generate('package:path/abc def', request, a=1)
+        self.assertEqual(result, 'http://example.com/abc%20def')
+
     def test_add_already_exists(self):
         inst = self._makeOne()
         config = self._makeConfig(