Percent encoded forward slash is stil treated as a URL component delimiter #2507

heartsucker · 2017-10-28T15:13:39Z

Expected Behavior

When a forward slash (/) is percent encoded, it should not be treated as a delimiter in a URL but instead should be treated as a string character.

from flask import Flask
app = Flask(__name__)

@app.route('/<string:foo>')
def index(foo):
    return foo

app.run('localhost', 3000)

$ curl localhost:3000/foo%2Fbar
foo/bar

Actual Behavior

$ curl localhost:3000/foo%2Fbar
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server.  If you entered the URL manually please check your spelling and try again.</p>

Environment

Python version: Python 3.5.3
Flask version: 0.12.2
Werkzeug version: 0.12.2

venv:

click==6.7
Flask==0.12.2
itsdangerous==0.24
Jinja2==2.9.6
MarkupSafe==1.0
Werkzeug==0.12.2

Use Case

A website has the URL rule /<string:company>/<string:user>. Company names and users would have to have the slash character disallowed otherwise they would not be able to be cleanly represented as a URL.

A Second Example

A second issue that I assume is directly related is that url_for doesn't escape the forward slash.

from flask import Flask, Markup, request, redirect, url_for
app = Flask(__name__)

@app.route('/', methods=('GET', 'POST'))
def index():
    if request.method == 'POST':
        return redirect(url_for('other', foo=request.form['foo'], bar=request.form['bar']))
    else:
        return Markup(
            '''<form method="POST">
                 <input name="foo" type="text">
                 <input name="bar" type="text">
                 <input type="submit" value="Submit">
               </form>
            ''')


@app.route('/other/<string:foo>/<string:bar>')
def other(foo, bar):
    return '{}<br>{}'.format(foo, bar)


app.run('localhost', 3000)

In the browser, submitting foo/moarfoo and bar into the two fields yields the URL /foo/moarfoo/bar instead of /foo%2Fmoarfoo/bar.

The text was updated successfully, but these errors were encountered:

ThiefMaster · 2017-10-28T15:18:22Z

See #900 and pallets/werkzeug#21.

FYI, if you may be able to use <path:foo> to have a segment that can contain slashes. However, I think both company names and user names should be "slugified" (pure ascii, no weird chars, no whitespace, no slashes, other stuff converted to dashes) before being used in an URL. For example, you'd convert "Greedy Corp" to "greedy-corp" and "Slightly/Evil Org" to "slightly-evil-org"

ThiefMaster closed this as completed Oct 28, 2017

davidism mentioned this issue Mar 16, 2020

unexpected variable evaluation on url with encoded slashes #3534

Closed

github-actions bot locked as resolved and limited conversation to collaborators Nov 14, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Percent encoded forward slash is stil treated as a URL component delimiter #2507

Percent encoded forward slash is stil treated as a URL component delimiter #2507

heartsucker commented Oct 28, 2017 •

edited

Loading

ThiefMaster commented Oct 28, 2017

Percent encoded forward slash is stil treated as a URL component delimiter #2507

Percent encoded forward slash is stil treated as a URL component delimiter #2507

Comments

heartsucker commented Oct 28, 2017 • edited Loading

Expected Behavior

Actual Behavior

Environment

Use Case

A Second Example

ThiefMaster commented Oct 28, 2017

heartsucker commented Oct 28, 2017 •

edited

Loading