On 14 Feb 2014, at 10:44, Sven Van Caekenberghe <[email protected]> wrote:

> On 14 Feb 2014, at 10:34, Johan Brichau <[email protected]> wrote:
> 
>> No, because the original request was 'foo%20%2B%20' 
>> 
>> If it prints it, the + should be encoded again.
> 
> Why ?

The + character in a url is decoded as a space:

self assert: (ZnPercentEncoder new decode: '+' = ' ')

So, because I notice that the incoming url is decoded when parsing to a ZnUrl's 
path segments, recoded when printed and then again decoded, the following 
happens:
- '%2B' (encoding of +) gets decoded to '+' (correct)
- '+' gets encoded as '+' (incorrect)
- '+' gets decoded as ' ' (correct)


> How exactly is this creating problems ?

In Seaside, when you serialize an input form using a jquery ajax request and 
you enter a '+' in the input form, the browser correctly encodes the '+' 
character to a '%2B' in the request url.
However, because the Zinc server performs the above transformation, the '+' 
becomes a ' ' in the incoming value of the Seaside callback.

The + is not a safe character because it is an encoding of a space.

Johan



Reply via email to