[Django] #32702: urlize() should not decode URL fragments

10 views

Skip to first unread message

Django

unread,

Apr 30, 2021, 7:39:45 PM4/30/21

to django-...@googlegroups.com

#32702: urlize() should not decode URL fragments
---------------------------------------+------------------------
Reporter: Victor Shih | Owner: nobody
Type: Bug | Status: new
Component: Utilities | Version: 3.2
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
---------------------------------------+------------------------
Currently `urlize()` will unquote then quote the fragment component of
URLs. This transformation can be problematic - for example if it contains
a %-encoded URL:

example.com/home#next=https%3A%2F%2Fexample2.com

This results in:

<a
href="https://example.com/home#next=https://example2.com">https://example.com/home#next=https%3A%2F%2Fexample2.com</a>

Note how the generated href has its fragment decoded.

Because the formatting for the fragment is completely arbitrary and site-
dependent, I suggest that the fragment should not be altered at all and
simply rendered as-is.

Patch: https://github.com/django/django/pull/14275

--
Ticket URL: <https://code.djangoproject.com/ticket/32702>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

Django

unread,

May 13, 2021, 5:35:48 AM5/13/21

to django-...@googlegroups.com

#32702: urlize() should not decode URL fragments

-----------------------------+--------------------------------------

Reporter: Victor Shih | Owner: nobody

Type: Bug | Status: closed
Component: Utilities | Version: 3.2
Severity: Normal | Resolution: needsinfo

Keywords: | Triage Stage: Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-----------------------------+--------------------------------------
Changes (by Carlton Gibson):

* status: new => closed
* resolution: => needsinfo

Comment:

Hi Victor — I'm going to mark this as needsinfo following Florian's
comment on the PR. I'm very happy to discuss this with you, and see if we
can make sure we're 100% clear before proceeding (but I think we need that
discussion before moving forwards) — I hope that makes sense. Thanks.