WSGIRequest.path not quoted properly

[ianb]

WSGIRequest.__init__ contains the code:

        self.path = '%s%s' % (script_name, path_info)

Both script_name and path_info are url-decoded. That is, if you request /Foo%20bar then PATH_INFO will be '/Foo bar' -- to get the accurate path you have to re-encode both values.

[krisneuharth]

Patch for #11903

[Jacob]

Need a test for this.

[Fabián Ezequiel Gallina]

patch with test for bug 11903

[Fabián Ezequiel Gallina]

The proposed approach was not correct, urlencode works with a two-element tuples or a dictionary. urlquote should be used for it since script_name and path_info are strings.

The attached patch contains the correction for it and a test.

[Chris Beaven]

It seems like this could introduce backwards compatible issues (even though from a quick look at the docs there's no specific mention of quoted/unquoted when referring to request.path.

Is there some standard which the proposal to quote request.path would follow? I couldn't find any reference in pep333.

This also creates a disparate situation between path and path_info. Applications may be using both, and to have one quoted and the other not seems odd. And since path_info is used by django's url resolution it may cause problems quoting that.

In any case, this isn't a regression and probably needs some discussion, so I'm bumping out of the already-late 1.2 phase.

[ianb]

The quoting of PATH_INFO is specified in the CGI specification, which PEP 333 refers to. This is also true for mod_python (and Apache generally).

[Aymeric Augustin]

I believe the current behavior is correct. Django handles the encoding / decoding wherever necessary and provides unicode objects to the programmer.

request.path is unicode and has no reason to be url-encoded. (In the code quoted in the original report, path_info is unicode, which guarantees that self.path is unicode.)

This is a custom API of Django, which means we aren't bound by the WSGI or CGI spec there (while we are for request.META['PATH_INFO']).

To sum up, if I'm typing "www.mysite.com/foo bar/" in my browser, the browser will issue a request for "/foo%20bar/", but Django will convert that back to u"/foo bar/".