id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
26005	uri_to_iri() perfoms percent decoding incorrectly	Chronial	varun naganathan	"The current implementation of uri_to_iri is incorrect.

In step two of [http://tools.ietf.org/html/rfc3987.html#section-3.2 the algorithm], it should:

> Convert all percent-encodings (""%"" followed by two hexadecimal    digits) to the corresponding octets, except those corresponding       to ""%"", characters in ""reserved"", and characters in US-ASCII not       allowed in URIs.

But instead it just runs an unquote ([https://github.com/django/django/blob/dbb0df2a0ec5bee80bee336fc81408efb30b7e47/django/utils/encoding.py#L199 source])

This also makes this statement from [https://docs.djangoproject.com/en/1.9/ref/unicode/#uri-and-iri-handling the docs] a lie:

> Both iri_to_uri() and uri_to_iri() functions are idempotent, which means the following is always true:
> uri_to_iri(uri_to_iri(some_string)) == uri_to_iri(some_string)

But at the moment 

{{{
uri_to_iri(uri_to_iri(""%2525"")) == ""%"" != ""%25"" == uri_to_iri(""%2525"")
}}}


"	Bug	closed	Utilities	1.8	Normal	fixed			Ready for checkin	1	0	0	0	0	0