1. cherrypy
  2. CherryPy
Issue #248 resolved

DecodingFilter and URIs

Anonymous created an issue

DecodingFilter should also decode the request path and the parameter names, not only the parameter values. See:

http://www.w3.org/TR/html4/appendix/notes.html#h-B.2

According to the spec, it should always use UTF-8, though allowing the user to override this is probably acceptable.

This fix makes even more sense when using positional parameters:

{{{

!python

def default(self, word):
    return word

}}}

With the above code, there is no reason why /?word=perché should work and /perché shouldn't.

Reported by steadicat

Comments (2)

  1. Robert Brewer

    This ticket raises three different concerns.

    1. URL's, param keys and param values which have been "% HEX HEX" encoded should all be decoded. This was partially implemented already, and is now done earlier in the request process with changeset [561].

    2. Positional params which have been utf-8 encoded should be decoded so that the example code (above) works. If this didn't work before it does now with [561]. See test.test_core.Params.default for an example.

    3. Parameter values ("?key=value") which have been utf-8 encoded are already decoded with the decoding filter; the keys should be decoded likewise. However, this breaks CherryPy in a fundamental way, since CP passes parameters as function keyword arguments; Python requires those keys to be strings, not unicode. Therefore, utf-8-encoded keys should ''not'' be decoded, but should be passed as-is, IMO. Therefore, I'm closing this as fixed. Please open a separate ticket if you want some other behavior on this particular point, since the other issues have been fixed.

  2. Log in to comment