git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH] Do not unquote + into ' ' in URLs

From
Thomas Rast <trast@student.ethz.ch>
Date
Jul 23, 2010, 21:23 UTC
Message-ID
<db9c97908966fa332be07b2a9f5215679e35b9e0.1279920066.git.trast@student.ethz.ch>
In-Reply-To
<AANLkTinsixPihZRtduuB_0puX_ucC0HYqHPU0UJMX2e-@mail.gmail.com>

Since 9d2e942 (decode file:// and ssh:// URLs, 2010-05-23) the URL logic unquotes escaped URLs. For the %2B type of escape, this is conformant with RFC 2396. However, it also unquotes + into a space character, which is only appropriate for the query strings in HTTP. This notably broke fetching from the gtk+ repository.

Remove the corresponding bit of code.
Reported-by: Jasper St. Pierre <jstpierre@mecheye.net>
Signed-off-by: Thomas Rast <trast@student.ethz.ch>
---
Jasper St. Pierre wrote:
> Yep. http://www.ietf.org/rfc/rfc2396.txt defines '+' as a reserved character,
> but doesn't give a purpose for it. www-form-encoded replaces space with '+'
> but in a URL it can mean anything it wants.
So let's do this then, instead?

Based on the discussion, I would consider this a bugfix that should go in 1.7.2.1.

 t/t5601-clone.sh |   10 ++++++++--
 url.c            |    5 +----
 2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/t/t5601-clone.sh b/t/t5601-clone.sh
index 8abb71a..4431dfd 100755
--- a/t/t5601-clone.sh
+++ b/t/t5601-clone.sh
@@ -178,8 +178,14 @@ test_expect_success 'clone respects global branch.autosetuprebase' '
 
 test_expect_success 'respect url-encoding of file://' '
 	git init x+y &&
-	test_must_fail git clone "file://$PWD/x+y" xy-url &&
-	git clone "file://$PWD/x%2By" xy-url
+	git clone "file://$PWD/x+y" xy-url-1 &&
+	git clone "file://$PWD/x%2By" xy-url-2
+'
+
+test_expect_success 'do not query-string-decode + in URLs' '
+	rm -rf x+y &&
+	git init "x y" &&
+	test_must_fail git clone "file://$PWD/x+y" xy-no-plus
 '
 
 test_expect_success 'do not respect url-encoding of non-url path' '
diff --git a/url.c b/url.c
index 2306236..fa4b8d4 100644
--- a/url.c
+++ b/url.c
@@ -90,10 +90,7 @@ static char *url_decode_internal(const char **query, const char *stop_at, struct
 			}
 		}
 
-		if (c == '+')
-			strbuf_addch(out, ' ');
-		else
-			strbuf_addch(out, c);
+		strbuf_addch(out, c);
 		q++;
 	} while (1);
 	*query = q;
-- 
1.7.2.rc3.335.g26d7d
Previous: Jasper St. PierreNext: Ævar Arnfjörð Bjarmason
Message 5 of 18 in “URL decoding changed semantics of + in URLs”
  1. Thomas RastJul 23, 2010
  2. Thomas RastJul 23, 2010
  3. Ævar Arnfjörð BjarmasonJul 23, 2010
  4. Jasper St. PierreJul 23, 2010
  5. Do not unquote + into ' ' in URLsThomas Rast, Jul 23, 2010
  6. Ævar Arnfjörð BjarmasonJul 23, 2010
  7. Junio C HamanoJul 23, 2010
  8. Thomas RastJul 23, 2010
  9. Do not unquote + into ' ' in URLsThomas Rast, Jul 24, 2010
  10. Jasper St. PierreJul 31, 2010
  11. Thomas RastJul 31, 2010
  12. Ralf EbertAug 6, 2010
  13. Jeff KingJul 26, 2010
  14. Ævar Arnfjörð BjarmasonJul 26, 2010
  15. Jasper St. PierreJul 26, 2010
  16. Matthieu MoyJul 26, 2010
  17. Ævar Arnfjörð BjarmasonJul 26, 2010
  18. Jasper St. PierreJul 26, 2010

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.