Skip to content

Encode square brackets in path segments#9410

Open
eyupcanakman wants to merge 1 commit into
square:masterfrom
eyupcanakman:fix/encode-square-brackets-in-path-segments
Open

Encode square brackets in path segments#9410
eyupcanakman wants to merge 1 commit into
square:masterfrom
eyupcanakman:fix/encode-square-brackets-in-path-segments

Conversation

@eyupcanakman
Copy link
Copy Markdown

HttpUrl.Builder.addPathSegment() and setPathSegment() did not percent-encode [ and ] in path segments. RFC 3986 section 3.3 reserves brackets for IPv6 literals in the authority component, so they should be percent-encoded when they appear in path segments.

Added a PATH_SEGMENT_ENCODE_SET_RAW constant that includes [] and applied it to raw-input methods (addPathSegment, addPathSegments, setPathSegment). addEncodedPathSegment(), setEncodedPathSegment(), and URL parsing preserve literal brackets as before.

Fixes #6790

@eyupcanakman
Copy link
Copy Markdown
Author

@swankjesse on your 2023 ask about confirming browsers. Browsers per WHATWG leave [ and ] alone in path segments (neither is in the path percent-encode set), so new URL("https://x/a[0]").pathname stays /a[0] in Chrome and Firefox. The fix here matches RFC 3986 and Java URI (which already rejects [ in paths) but differs from what browsers do, which CONTRIBUTING prefers.

Should I close this? addEncodedPathSegment() and parsing already preserve literal brackets, so the only behavioral change is on the raw-input methods.

@JakeWharton
Copy link
Copy Markdown
Collaborator

The "encoded" variants of the functions are the "raw" ones. These functions are the ones which are used by 99.9% of callers. We should fix these. Retrofit wants this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HttpUrl#addPathSegment does not encode square brackets '[', ']

2 participants