" 2026 Feb 27 by Vim Project Make the hostname validation more strict
" 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
" 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+" 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
" Copyright: Copyright (C) 2016 Charles E. Campbell {{{1
" Permission is hereby granted to use and distribute this code,
" with or without modifications, provided that this copyright
" netrw#RFC2396: converts %xx into characters {{{2
function netrw#RFC2396(fname)
- let fname = escape(substitute(a:fname,'%\(\x\x\)','\=printf("%c","0x".submatch(1))','ge')," \t")
- return fname
+ return substitute(a:fname, '%\(\x\x\)', '\=printf("%c","0x".submatch(1))', 'ge')
endfunction
" netrw#UserMaps: supports user-specified maps {{{2
call assert_false(filereadable(fname), 'Command injection via pipe in file URL')
endfunc
+func Test_netrw_RFC2396()
+ let fname = 'a%20b'
+ call assert_equal('a b', netrw#RFC2396(fname))
+endfunc
+
" vim:ts=8 sts=2 sw=2 et