--- a/req.py	Thu Sep 23 13:10:29 2010 +0200
+++ b/req.py	Thu Sep 23 12:16:36 2010 +0200
@@ -174,6 +174,8 @@
         """return an absolute URL using params dictionary key/values as URL
         parameters. Values are automatically URL quoted, and the
         publishing method to use may be specified or will be guessed.
+
+        raises :exc:`ValueError` if None is found in arguments
         """
         # use *args since we don't want first argument to be "anonymous" to
         # avoid potential clash with kwargs
@@ -201,7 +203,6 @@
             return u'%s%s' % (base_url, path)
         return u'%s%s?%s' % (base_url, path, self.build_url_params(**kwargs))
 
-
     def build_url_params(self, **kwargs):
         """return encoded params to incorporate them in an URL"""
         args = []
@@ -209,6 +210,8 @@
             if not isinstance(values, (list, tuple)):
                 values = (values,)
             for value in values:
+                if value is None:
+                    raise ValueError(_('unauthorized value'))
                 args.append(u'%s=%s' % (param, self.url_quote(value)))
         return '&'.join(args)
 

--- a/test/unittest_req.py	Thu Sep 23 13:10:29 2010 +0200
+++ b/test/unittest_req.py	Thu Sep 23 12:16:36 2010 +0200
@@ -17,9 +17,11 @@
 # with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
 from logilab.common.testlib import TestCase, unittest_main
 from cubicweb.req import RequestSessionBase
+from cubicweb.devtools.testlib import CubicWebTC
+
 
 class RebuildURLTC(TestCase):
-    def test(self):
+    def test_rebuild_url(self):
         rebuild_url = RequestSessionBase(None).rebuild_url
         self.assertEquals(rebuild_url('http://logilab.fr?__message=pouet', __message='hop'),
                           'http://logilab.fr?__message=hop')
@@ -28,6 +30,18 @@
         self.assertEquals(rebuild_url('http://logilab.fr?vid=index', __message='hop'),
                           'http://logilab.fr?__message=hop&vid=index')
 
+    def test_build_url(self):
+        req = RequestSessionBase(None)
+        req.from_controller = lambda : 'view'
+        req.relative_path = lambda includeparams=True: None
+        req.base_url = lambda : 'http://testing.fr/cubicweb/'
+        self.assertEqual(req.build_url(), u'http://testing.fr/cubicweb/view')
+        self.assertEqual(req.build_url(None), u'http://testing.fr/cubicweb/view')
+        self.assertEqual(req.build_url('one'), u'http://testing.fr/cubicweb/one')
+        self.assertEqual(req.build_url(param='ok'), u'http://testing.fr/cubicweb/view?param=ok')
+        self.assertRaises(AssertionError, req.build_url, 'one', 'two not allowed')
+        self.assertRaises(ValueError, req.build_url, 'view', test=None)
+
 
 if __name__ == '__main__':
     unittest_main()