If an URL path element contains %2F (an escaped "/") Flask.route considers it as an unescaped slash. #900
Description
Here's an example:
from flask import Flask
app = Flask(__name__)
@app.route('/<urlvar>')
def hello_world(urlvar):
return 'Hello World! ' + repr(urlvar)
if __name__ == '__main__':
app.run(debug=True)
When running:
curl http://localhost:5000/aaa%2Fbbb
I would expect to see:
Hello World! u'aaa/bbb'
Instead I get:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
I tested this against Flask 0.9 and Flask 0.10.1. Both had the same error.
While searching for existing bug reports, I came across this: pallets/werkzeug#21
Is this related? If yes, what's the status?
In any case, being a WSGI spec problem or not, this is behaviour is incorrect!