Bug #10619: URI::HTTP#query= behavior changed for 2396 uris

• Status: Closed
• Assignee: naruse (Yui NARUSE)
• Target version: -
• ruby -v: ruby 2.2.0dev (2014-12-18 trunk 48886) [x86_64-darwin14]
• Backport: 2.0.0: DONTNEED, 2.1: DONTNEED, 2.2: DONE

[tenderlovemaking (Aaron Patterson)]

Hi,

r48244 changed the behavior of the query method on uri objects generated by the 2396 parser. Here is a test to demonstrate the change:

require 'test/unit'
require 'uri'

module URI

class TestRFC2396 < Test::Unit::TestCase
  def test_query_on_parse
    parser = URI::RFC2396_Parser.new
    uri = parser.parse "http://www.example.com/parse?location[]=1"
    assert_equal 'location[]=1', uri.query
  end
end

end

This test passed before r48244. I've attached a patch that fixes it and maintains the fix for Bug #10402

[naruse (Yui NARUSE)]

• Status changed from Open to Closed
• % Done changed from 0 to 100

Applied in changeset r48934.

---

• lib/uri/generic.rb (URI::Generic#query=): don't escape []^
  on both rfc2396 and rfc3986. [Bug #10619]

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.0.0: UNKNOWN, 2.1: UNKNOWN to 2.0.0: DONTNEED, 2.1: DONTNEED, 2.2: REQUIRED

[naruse (Yui NARUSE)]

• Backport changed from 2.0.0: DONTNEED, 2.1: DONTNEED, 2.2: REQUIRED to 2.0.0: DONTNEED, 2.1: DONTNEED, 2.2: DONE

ruby_2_2 r48950 merged revision(s) 48934.

[jimpo (Jim Posen)]

In r48934, why were both the RFC 2396 and RFC 3986 parsers changed to allow unescaped square brackets? The RFC 3986 spec does not allow square brackets. In @tenderlove's attached patch, [ and ] are still escaped when the RFC 3986 parser is used.

Also, the RFC 3986 parser accepts URIs with a % that is not followed by hex digits, which should be forbidden.

[naruse (Yui NARUSE)]

• Related to Bug #12235: URI.encode issue with square brackets added