Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: should not replace literal + with a space in the query string #960

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

macabeus
Copy link
Contributor

@macabeus macabeus commented Dec 22, 2024

This PR fixes #943, in which a literal + from the query string is replaced with a space.

@macabeus macabeus changed the title fix: should not replace literal + with in the query string fix: should not replace literal + with a space in the query string Dec 22, 2024
src/compose.ts Outdated
if(memory === -1) temp = url.slice(start).replace(/\\+|%20/g, ' ')
else temp = url.slice(start, memory).replace(/\\+|%20/g, ' ')
if(memory === -1) temp = url.slice(start)
else temp = url.slice(start, memory)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need to replace %20 with space because we are already calling decodeURIComponent earlier.

src/compose.ts Outdated
@@ -694,7 +692,7 @@ export const composeHandler = ({
}`
} else {
fnLiteral += `if(c.qi !== -1) {
let url = '&' + decodeURIComponent(c.url.slice(c.qi + 1))
let url = '&' + decodeURIComponent(c.url.slice(c.qi + 1).replaceAll('+', ' '))
Copy link
Contributor Author

@macabeus macabeus Dec 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should replace + with a space before calling decodeURIComponent.
Otherwise, we won't know whether a + comes from a space (and we want to replace it with space) or comes from a %2B (and we want to keep it).

@SaltyAom
Copy link
Member

Thanks for the pull request, but I would seconded this.

According to HTML 4.01 specification, section 17.13.4.

application/x-www-form-urlencoded
This is the default content type. Forms submitted with this content type must be
encoded as follows:

  1. Control names and values are escaped. Space characters are replaced by ‘+’,
    and then reserved characters are escaped as described in [RFC1738]

By default, an HTML form would be submitted in an application/x-www-form-urlencoded format, which appended data to query parameters for GET request.

This means this PR would break an HTML form parsing functionality.

Although RFC 3986 states that pathname should use %20 for space but leave an interpretation for query parameters (if I understood it correctly)

Furthermore, according to the Web Standard implementation of URLSearchParams which treats + as space.

console.log(new URL("https://saltyaom.com?message=hello+world").searchParams.get("message"))
// hello world

This implied that JavaScript developers would likely expect the implementation of URLSearchParams to be the standard.

So I'm likely going to stick with the current implementation of treating + as a space unless there's a solid counter-argument for my reasoning.

@SaltyAom SaltyAom self-assigned this Feb 16, 2025
@SaltyAom SaltyAom added the wontfix This will not be worked on label Feb 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix This will not be worked on
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Broken query params handling behavier on escaped character "%2B" (the "+" symbol) in 1.1.26
2 participants