#25572: APPEND_SLASH (and others) sometimes redirect to invalid URL by encoding
the
entire URI
-----------------------------+--------------------
Reporter: aminehaddad | Owner: nobody
Type: Bug | Status: new
Component: Core (URLs) | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------
When APPEND_SLASH is True (default), the request for "/test/+123?foo=+123"
redirects to "/test/%2B123/?foo=%2B123" instead of
"/test/+123/?foo=%2B123".
Sources:
http://stackoverflow.com/a/332897 (the "+" should not be encoded in escape
or encodeURI)
https://github.com/django/django/blob/master/django/http/request.py#L122
https://en.wikipedia.org/wiki/Percent-encoding#Percent-
encoding_reserved_characters
https://www.ietf.org/rfc/rfc2396.txt "Likewise, a URI must be separated
into its components before the escaped characters within those components
can be safely decoded."
Sample urls.py line that redirects to the invalid "/test/%2B123/" when a
slash is missing:
{{{
url(r'^test/(?P<foobar>\+[0-9]+)/$', 'test', name='test')
}}}
Solution: It should redirect to: /test/+123/?... instead of
/test/%2B123/?...
--
Ticket URL: <https://code.djangoproject.com/ticket/25572>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/054.a608ca0ddbc2a3f6a8ea7ebc4ebc750e%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
