Copyright © https://mongoose-os.com

Mongoose OS Forum

frame

who does url_decode?

In mongoose version 4, event->request_info->uri was delivered to the user handler already url_decoded ("%20" becomes " ", etc). In mongoose version 6, http_message.uri delivered to the user handler is NOT url_decoded (still has "%20", etc). From documentation, it is not clear who is supposed to do the decoding - the mongoose library or the user. Note that running url_decode twice is incorrect and will mangle the URL (url_decode is not idempotent). Is current behaviour a bug (uri should be decoded) or an omission in the documentation ("user MUST url_decode http_message.uri before using it"). What other data fields the user must url_decode before using? http_message.query_string too? K.O.

Comments

  • SergeySergey Dublin, Ireland

    That's a good question.
    What do you think would be the best way to do?

  • two ideas: a) keep new versions of library compatible with old versions - if old version does "X", do same thing in the new version and avoid surprises to long time users. Too late for that now. b) do it any way you want, but document it. In this case, every example code must contain explicit calls to url_decode to tell the user that they must decode the url themselves. The explanation of the "uri" field should clearly say that it is not url_decoded. K.O. P.S. Also always remember that url_decode and url_encode are not idempotent - calling them twice will mangle the data.

  • SergeySergey Dublin, Ireland

    I think that API calls that fetch parameters and header values should url-decode the result.
    Parsed request, however, should be stored as-is - meaning, the URI should not be decoded. Rationale: there could be cases when the original string is required.

    And yes, that should be properly documented. We are working on that at the moment.
    Does that sound reasonable to you?

Sign In or Register to comment.