#24013: reverse() escapes unreserved characters supplied by prefix
-----------------------------+-------------------------------------
Reporter: tgerdes | Owner: bpeschier
Type: Bug | Status: assigned
Component: Core (URLs) | Version: 1.6
Severity: Normal | Resolution:
Keywords: ams2015 | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+-------------------------------------
Comment (by bpeschier):
So the problem is very similar, as mentioned, to #22223 and the solution
is also very similar: treat the prefix as another path segment and use the
same safe-argument when calling {{{urlquote}}} 1]. This makes the test for
#20022 fail, but that test is incorrect and can be easily fixed (it should
test escaping of {{{%}}}, not {{{~}}}, which is an unreserved char)
There is another problem however: all url patterns should be valid regex,
but the script prefix does not have to be (or does it?). When
{{{reverse}}} tries to use the prefix, it assumes it needs to normalize it
and thus that it is a valid regex. This breaks {{{normalize}}} when you
add a singular {{{)}}} which is a valid path part, but not valid regex.
The prefix-argument is undocumented and defaults to the script prefix. So
we can either assume all prefixes can be treated as plain strings, or we
can regex-escape {{{get_script_prefix}}} when {{{reverse}}} populates the
prefix 2].
1]:
https://github.com/django/django/blob/master/django/core/urlresolvers.py#L448
2]:
https://github.com/django/django/blob/master/django/core/urlresolvers.py#L532
--
Ticket URL: <https://code.djangoproject.com/ticket/24013#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.60fbe83f5f255da92d250e82318608e0%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
