#20530: Incorrect QUERY_STRING handling on Python 3
-----------------------------+--------------------
Reporter: mitsuhiko | Owner: nobody
Type: Bug | Status: new
Component: Core (URLs) | Version: 1.5
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+--------------------
Certain browsers (IE cough) will not fully encode the path in the request
in all situations. As such you will encounter non ascii letters in the
request line. Currently the QueryDict does not handle that properly. In
addition to that it also means that the WSGI `QUERY_STRING` variable needs
to be handled the same way as `PATH_INFO` and `SCRIPT_NAME`.
Here is what is necessary to handle the case properly:
1. the `environ['QUERY_STRING']` attribute needs to go through the PEP
3333 dance on Python 3 that creates a bytes object
2. unquoting happens on the bytes
3. finally everything is done to the intended encoding (UTF-8)
The logic currently employed by QueryDict in combination with the
WSGIRequest object is double wrong:
1. the WSGIRequest object is not properly doing the dance and passes a
(potentially mangled) unicode string to query dict
2. the query dict decodes that incorrectly formatted unicode string (WSGI
on 3.x intentionally incorrectly encodes information) causing invalid data
to show up in request.args
Independently of that if bytes are passed to the QueryDict it does not do
proper decoding unless the bytes are a subset of ASCII.
--
Ticket URL: <https://code.djangoproject.com/ticket/20530>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.87303b3b3bae05a15c828198f1962a24%40djangoproject.com?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
