From: Ben Darnell <ben@bendarnell.com>
Date: Sun, 12 May 2013 20:12:27 +0000 (-0400)
Subject: Use plus=False when constructing and decoding url paths.
X-Git-Tag: v3.1.0~76^2~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=917fe80f38c0b5053a73decce6f1e40256e94d4e;p=thirdparty%2Ftornado.git

Use plus=False when constructing and decoding url paths.
---

diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
index 6f5281271..a7f89620d 100644
--- a/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@ -559,6 +559,18 @@ class WSGISafeWebTest(WebTestCase):
                                 u('query'): [u('bytes'), u('c3a9')],
                                 })
 
+    def test_decode_argument_plus(self):
+        # These urls are all equivalent.
+        urls = ["/decode_arg/1%20%2B%201?foo=1%20%2B%201&encoding=utf-8",
+                "/decode_arg/1%20+%201?foo=1+%2B+1&encoding=utf-8"]
+        for url in urls:
+            response = self.fetch(url)
+            response.rethrow()
+            data = json_decode(response.body)
+            self.assertEqual(data, {u('path'): [u('unicode'), u('1 + 1')],
+                                    u('query'): [u('unicode'), u('1 + 1')],
+                                    })
+
     def test_reverse_url(self):
         self.assertEqual(self.app.reverse_url('decode_arg', 'foo'),
                          '/decode_arg/foo')
@@ -568,6 +580,8 @@ class WSGISafeWebTest(WebTestCase):
                          '/decode_arg/%E9')
         self.assertEqual(self.app.reverse_url('decode_arg', u('\u00e9')),
                          '/decode_arg/%C3%A9')
+        self.assertEqual(self.app.reverse_url('decode_arg', '1 + 1'),
+                         '/decode_arg/1%20%2B%201')
 
     def test_uimodule_unescaped(self):
         response = self.fetch("/linkify")
diff --git a/tornado/web.py b/tornado/web.py
index c43bca45c..7bc715d7e 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -1477,7 +1477,8 @@ class Application(object):
                         def unquote(s):
                             if s is None:
                                 return s
-                            return escape.url_unescape(s, encoding=None)
+                            return escape.url_unescape(s, encoding=None,
+                                                       plus=False)
                         # Pass matched groups to the handler.  Since
                         # match.groups() includes both named and unnamed groups,
                         # we want to use either groups or groupdict but not both.
@@ -2148,7 +2149,7 @@ class URLSpec(object):
         for a in args:
             if not isinstance(a, (unicode_type, bytes_type)):
                 a = str(a)
-            converted_args.append(escape.url_escape(utf8(a)))
+            converted_args.append(escape.url_escape(utf8(a), plus=False))
         return self._path % tuple(converted_args)
 
 url = URLSpec
diff --git a/tornado/wsgi.py b/tornado/wsgi.py
index 62cff5906..ae90674e0 100644
--- a/tornado/wsgi.py
+++ b/tornado/wsgi.py
@@ -284,7 +284,8 @@ class WSGIContainer(object):
         environ = {
             "REQUEST_METHOD": request.method,
             "SCRIPT_NAME": "",
-            "PATH_INFO": to_wsgi_str(escape.url_unescape(request.path, encoding=None)),
+            "PATH_INFO": to_wsgi_str(escape.url_unescape(
+                    request.path, encoding=None, plus=False)),
             "QUERY_STRING": request.query,
             "REMOTE_ADDR": request.remote_ip,
             "SERVER_NAME": host,