Skip to content

normalized_user and normalized_password should not percent-encode characters in sub-delims #548

@Yihao-G

Description

@Yihao-G

The sub-delims characters should not be percent-encoded by the normalized_user and normalized_password methods in Addressable::URI as they are valid characters according to RFC 3986:

   userinfo      = *( unreserved / pct-encoded / sub-delims / ":" )
   pct-encoded   = "%" HEXDIG HEXDIG
   unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
   sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
                 / "*" / "+" / "," / ";" / "="

Current behaviour:

>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_user
=> "u%24er%21"
>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_password
=> "pa%24s"
>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_userinfo
=> "u%24er%21:pa%24s"

Expected behaviour:

>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_user
=> "u$er!"
>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_password
=> "pa$s"
>> Addressable::URI.parse('https://u$er!:[email protected]').normalized_userinfo
=> "u$er!:pa$s"

The characters are encoded in the following two places:

Addressable::URI.normalize_component(
self.user.strip,
Addressable::URI::NormalizeCharacterClasses::UNRESERVED
)

Addressable::URI.normalize_component(
self.password.strip,
Addressable::URI::NormalizeCharacterClasses::UNRESERVED
)

The second parameter to be passed to Addressable::URI.normalize_component should be /[^#{CharacterClasses::UNRESERVED + CharacterClasses::SUB_DELIMS}]/ instead of just /[^#{CharacterClasses::UNRESERVED}]/

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions