Ian Bicking wrote:
OK, another proposal entirely: we kill SCRIPT_NAME and PATH_INFO, and introduce two equivalent variables that hold the NOT url-decoded values.
Yes, that was my preferred option, it makes all the worries about encodings quite moot: everything is effectively ASCII; they'll work fine both as byte native strings in Python 2 and unicode native strings in Python 3.
Although I would prefer not to *kill* SCRIPT_NAME/PATH_INFO, but to add to them, when the raw name and info are available. A server or middleware should *not* attempt to recreate these values from the processed SCRIPT_NAME/PATH_INFO values(*).
So when you see (eg.) 'wsgi.script_name_raw' and 'wsgi.path_info_raw' in your environ, you can be 100% sure they're correct and you can go ahead and use IRIs (and %2F if you must). If you don't see them, you have to continue to rely on the SCRIPT_NAME/PATH_INFO, so either fall back to ASCII-only URLs or take your chances with the charset lottery that is the current status quo.
If, like most applications, you don't care about non-ASCII URLs, you can ignore the whole issue and continue using SCRIPT_NAME/PATH_INFO.
(*: although arguably a middleware that recreates them from Apache's REQUEST_URI is partially possible.)
i.e., ideally decoding should happen on path segments, each segment separated by a real /.
That is correct. Apache still disables paths with '%2F' in as a security precaution, but that's easily turned off.
If we do that, then the only really tricky thing left is HTTP_COOKIE
I don't think that's particularly tricky is it? In as much as non-ASCII characters in the Cookie header are already completely broken everywhere, so everyone has to use ad-hoc encoding methods.
As Cookie is an actual HTTP header the encoding should presumably be ISO-8859-1, but I don't think it actually works anywhere.
-- And Clover mailto:a...@doxdesk.com http://www.doxdesk.com/ -- And Clover mailto:a...@doxdesk.com http://www.doxdesk.com/ _______________________________________________ Web-SIG mailing list Web-SIG@python.org Web SIG: http://www.python.org/sigs/web-sig Unsubscribe: http://mail.python.org/mailman/options/web-sig/archive%40mail-archive.com
