Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add function for encoding with application/x-www-form-urlencoded and use it internally #1138

Open
iamed2 opened this issue Dec 21, 2023 · 2 comments

Comments

@iamed2
Copy link
Contributor

iamed2 commented Dec 21, 2023

The HTML spec (at least 4 and 5, which I have linked) requires that be encoded as + in application/x-www-form-urlencoded. Python has a function for this urllib.parse.quote_plus, HTTP.jl should probably also have one, and use it for encoding application/x-www-form-urlencoded.

HTML 4: https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1
HTML 5: https://url.spec.whatwg.org/#urlencoded-serializing (the "true" argument is spaceAsPlus=true)

@quinnj
Copy link
Member

quinnj commented Dec 24, 2023

We currently have:

# application/x-www-form-urlencoded
    return write(stream, URIs.escapeuri(body))

are you aware of that? or are there issues with not conforming to the spec quite right for that?

@nguiard
Copy link
Contributor

nguiard commented Mar 31, 2024

Yes, this is actually incorrect. If you have:

post_params = Dict("p1" => "something with a space", "p2" => "yes no")

Then,

URIs.escapeuri(post_params)

will give you

"p2=yes%20no&p1=something%20with%20a%20space

Which is incorrect. It should actually be:

"p2=yes+no&p1=something+with+a+space"

The result is then entirely dependant on the resiliency and the smartness of the server at the other end receiving your incorrect encoding. You don't want to rely on that.

A more correct solution would be at least to do:

replace(URIs.escapeuri(post_params), "%20" => "+")

This is the same problem in reverse that I pointed out in #1118 : you cannot just reuse the exact same querystring encoding/decoding logic for application/x-www-form-urlencoded and expect it to work. They are actually different. This will lead to silent errors and hard-to-debug problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants