Andrushika opened a new pull request, #76147: URL: https://github.com/apache/airflow/pull/76147
## Why airflowctl builds the request path from the command arguments. For example, `variables delete KEY` sends `DELETE /api/v2/variables/KEY`. The key goes into the path without encoding. Core does not limit the characters in a variable key. But some characters have a special meaning in a URL: - `#` ends the path, so the client does not send the rest. - `?` starts the query string. - `/` and `..` move the request to another endpoint. I created the variables `a` and `a#b` on a 3.3.2 server. `airflowctl variables delete 'a#b'` deleted `a`, said that it deleted `a#b`, and exited with 0. ## What Encode every path parameter with `quote(value, safe="")`. The UI does the same with `encodeURIComponent` (`basePath.ts`). `.` and `..` are encoded too, because httpx removes them from the path as dot-segments. With this change, the same command deletes `a#b` and keeps `a`. Each call site still has to call the helper. A follow-up could move the path substitution into `Client`, so that a new operation cannot skip the encoding. Happy to do that if it makes sense. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
