Use plus=False when constructing and decoding url paths.

diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
index 6f528127144172b99cee64572f1f553785af8a65..a7f89620dc71dfed99cd31c7a3a3430ccac306ca 100644 (file)
--- a/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@ -559,6 +559,18 @@ class WSGISafeWebTest(WebTestCase):
                                 u('query'): [u('bytes'), u('c3a9')],
                                 })
 
+    def test_decode_argument_plus(self):
+        # These urls are all equivalent.
+        urls = ["/decode_arg/1%20%2B%201?foo=1%20%2B%201&encoding=utf-8",
+                "/decode_arg/1%20+%201?foo=1+%2B+1&encoding=utf-8"]
+        for url in urls:
+            response = self.fetch(url)
+            response.rethrow()
+            data = json_decode(response.body)
+            self.assertEqual(data, {u('path'): [u('unicode'), u('1 + 1')],
+                                    u('query'): [u('unicode'), u('1 + 1')],
+                                    })
+
     def test_reverse_url(self):
         self.assertEqual(self.app.reverse_url('decode_arg', 'foo'),
                          '/decode_arg/foo')
@@ -568,6 +580,8 @@ class WSGISafeWebTest(WebTestCase):
                          '/decode_arg/%E9')
         self.assertEqual(self.app.reverse_url('decode_arg', u('\u00e9')),
                          '/decode_arg/%C3%A9')
+        self.assertEqual(self.app.reverse_url('decode_arg', '1 + 1'),
+                         '/decode_arg/1%20%2B%201')
 
     def test_uimodule_unescaped(self):
         response = self.fetch("/linkify")

diff --git a/tornado/web.py b/tornado/web.py
index c43bca45c63cd9981914470ba2d5a19280f91402..7bc715d7e5835539a0c9432e7659af5a7ad94ccd 100644 (file)
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -1477,7 +1477,8 @@ class Application(object):
                         def unquote(s):
                             if s is None:
                                 return s
-                            return escape.url_unescape(s, encoding=None)
+                            return escape.url_unescape(s, encoding=None,
+                                                       plus=False)
                         # Pass matched groups to the handler.  Since
                         # match.groups() includes both named and unnamed groups,
                         # we want to use either groups or groupdict but not both.
@@ -2148,7 +2149,7 @@ class URLSpec(object):
         for a in args:
             if not isinstance(a, (unicode_type, bytes_type)):
                 a = str(a)
-            converted_args.append(escape.url_escape(utf8(a)))
+            converted_args.append(escape.url_escape(utf8(a), plus=False))
         return self._path % tuple(converted_args)
 
 url = URLSpec

diff --git a/tornado/wsgi.py b/tornado/wsgi.py
index 62cff59063258d16e1281aa1064243392efd8b3b..ae90674e0fd55e784e95365eec9a6243f51af64f 100644 (file)
--- a/tornado/wsgi.py
+++ b/tornado/wsgi.py
@@ -284,7 +284,8 @@ class WSGIContainer(object):
         environ = {
             "REQUEST_METHOD": request.method,
             "SCRIPT_NAME": "",
-            "PATH_INFO": to_wsgi_str(escape.url_unescape(request.path, encoding=None)),
+            "PATH_INFO": to_wsgi_str(escape.url_unescape(
+                    request.path, encoding=None, plus=False)),
             "QUERY_STRING": request.query,
             "REMOTE_ADDR": request.remote_ip,
             "SERVER_NAME": host,