[Web-SIG] URL quoting in WSGI (or the lack therof)

[Robert Brewer]

Luis Bruno wrote:
> Robert Brewer wrote:
> > > IMHO [changing CP's wsgiserver to do decoding] is the wrong answer
> > Why?
> >
> Because then I'm stuck monkey patching every WSGI server (and/or stuck
> using my own URL dispatcher) so that I don't lose the information that
> one of the forward slashes is NOT a path delimiter. You said that
> %-encoding is meant for slashes not participating in hierarchy
> semantics, if I read you correctly; so I think you'll agree with me on
> this.

Ah. Now I see. We've had a test case for this since Nov 2005 [1]. FWIW,
CherryPy took the option of special-casing forward slashes; those are
the only characters which are *not* decoded--they are left as %2F
characters in SCRIPT_NAME and PATH_INFO [2]:

    # Unquote the path+params (e.g. "/this%20path" -> "this path").
    # http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.2
    #
    # But note that "...a URI must be separated into its components
    # before the escaped characters within those components can be
    # safely decoded." http://www.ietf.org/rfc/rfc2396.txt, sec 2.4.2
    atoms = [unquote(x) for x in quoted_slash.split(path)]
    path = "%2F".join(atoms)
    environ["PATH_INFO"] = path

...and CherryPy then decodes these on the WSGI-app-side, only after the
dispatching step (to produce "virtual path" atoms) [3]:

    if func:
        # Decode any leftover %2F in the virtual_path atoms.
        vpath = [x.replace("%2F", "/") for x in vpath]
        request.handler = LateParamPageHandler(func, *vpath)
    else:
        request.handler = cherrypy.NotFound()

You're absolutely right; it would be nice to standardize a solution to
this. Of course, I'm going to propose we standardize *our* solution. ;)

> I'll see your CGI draft and raise you the URI spec.

Heh. Quoted in the code comments above.


Robert Brewer
fumanchu at aminus.org

[1] cf http://www.cherrypy.org/ticket/393
[2]
http://www.cherrypy.org/browser/trunk/cherrypy/wsgiserver/__init__.py#L3
14
[3] http://www.cherrypy.org/browser/trunk/cherrypy/_cpdispatch.py#L71