{"action":"closed","number":253,"pull_request":{"url":"https://api.github.com/repos/hyperium/http/pulls/253","id":216121595,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE2MTIxNTk1","html_url":"https://github.com/hyperium/http/pull/253","diff_url":"https://github.com/hyperium/http/pull/253.diff","patch_url":"https://github.com/hyperium/http/pull/253.patch","issue_url":"https://api.github.com/repos/hyperium/http/issues/253","number":253,"state":"closed","locked":false,"title":"Ignore percent encodings in Uri paths and queries","user":{"login":"dekellum","id":54785,"node_id":"MDQ6VXNlcjU0Nzg1","avatar_url":"https://avatars0.githubusercontent.com/u/54785?v=4","gravatar_id":"","url":"https://api.github.com/users/dekellum","html_url":"https://github.com/dekellum","followers_url":"https://api.github.com/users/dekellum/followers","following_url":"https://api.github.com/users/dekellum/following{/other_user}","gists_url":"https://api.github.com/users/dekellum/gists{/gist_id}","starred_url":"https://api.github.com/users/dekellum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dekellum/subscriptions","organizations_url":"https://api.github.com/users/dekellum/orgs","repos_url":"https://api.github.com/users/dekellum/repos","events_url":"https://api.github.com/users/dekellum/events{/privacy}","received_events_url":"https://api.github.com/users/dekellum/received_events","type":"User","site_admin":false},"body":"Previously the parsing (`PathAndQuery::from_shared`) checked for two hex digits after a `%`, but the `HEX_DIGIT` array included additional characters beyond valid hexadecimal numbers (like 'Z' and '~'). This was originally introduced in #135 (@carllerche).\r\n\r\nThe change of #233 introduced a special case leniency for \"%%\", with some claimed significance by its author @ernestas-poskus, but that handled only one possible case of malformed percent encoding, and did it by effectively aborting remaining checks and parsing (via `break`) for the remainder of the \"/path?query#anchor\".  I demonstrate this problem in a423e930 (separate branch, not intended for merge). To the extent that this allows injecting things like CRLF into subsequent characters of a `Uri`, which could break HTTP/1.0 request wire format, this could possibly have security implications?   As part of this PR, I first revert the changes from #233, but the remainder of this PR is a better fix for the original #202 as well, as demonstrated by new tests. \r\n\r\nBy comparison the WHATWG URL standard (https://url.spec.whatwg.org/) and implementations like the *rust-url* crate simply pass invalid percent encodings through unmodified (only treating these as a soft\r\nSyntaxViolation warning).\r\n\r\nSince `Uri` doesn't attempt any normalization of percent-encoded values, this PR simply treats '%' as a valid path or query character, with no special meaning for the subsequent characters.  The '%' character is *not* added to URI_CHARS because we still don't want to accept it, at least in a host name component of the authority.\r\n\r\nCompatibility: This shouldn't be a breaking change, because it generally makes `Uri` parsing *more* lenient for the path and query components.  The only exception to that is URIs with \"%%\" which are now treated uniformly.   `Uri` parsing should be slightly faster without the length, hex digit test and table, and the special case.","created_at":"2018-09-17T21:32:42Z","updated_at":"2018-09-18T18:14:50Z","closed_at":"2018-09-18T18:14:50Z","merged_at":"2018-09-18T18:14:49Z","merge_commit_sha":"d3737e36525d2497b3855a24612b38d3b3520f42","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/hyperium/http/pulls/253/commits","review_comments_url":"https://api.github.com/repos/hyperium/http/pulls/253/comments","review_comment_url":"https://api.github.com/repos/hyperium/http/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hyperium/http/issues/253/comments","statuses_url":"https://api.github.com/repos/hyperium/http/statuses/a3b41c98fb93a3e383a9d865a20dc706320ea6ae","head":{"label":"dekellum:ignore-percent-encoding","ref":"ignore-percent-encoding","sha":"a3b41c98fb93a3e383a9d865a20dc706320ea6ae","user":{"login":"dekellum","id":54785,"node_id":"MDQ6VXNlcjU0Nzg1","avatar_url":"https://avatars0.githubusercontent.com/u/54785?v=4","gravatar_id":"","url":"https://api.github.com/users/dekellum","html_url":"https://github.com/dekellum","followers_url":"https://api.github.com/users/dekellum/followers","following_url":"https://api.github.com/users/dekellum/following{/other_user}","gists_url":"https://api.github.com/users/dekellum/gists{/gist_id}","starred_url":"https://api.github.com/users/dekellum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dekellum/subscriptions","organizations_url":"https://api.github.com/users/dekellum/orgs","repos_url":"https://api.github.com/users/dekellum/repos","events_url":"https://api.github.com/users/dekellum/events{/privacy}","received_events_url":"https://api.github.com/users/dekellum/received_events","type":"User","site_admin":false},"repo":{"id":149185632,"node_id":"MDEwOlJlcG9zaXRvcnkxNDkxODU2MzI=","name":"http","full_name":"dekellum/http","private":false,"owner":{"login":"dekellum","id":54785,"node_id":"MDQ6VXNlcjU0Nzg1","avatar_url":"https://avatars0.githubusercontent.com/u/54785?v=4","gravatar_id":"","url":"https://api.github.com/users/dekellum","html_url":"https://github.com/dekellum","followers_url":"https://api.github.com/users/dekellum/followers","following_url":"https://api.github.com/users/dekellum/following{/other_user}","gists_url":"https://api.github.com/users/dekellum/gists{/gist_id}","starred_url":"https://api.github.com/users/dekellum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dekellum/subscriptions","organizations_url":"https://api.github.com/users/dekellum/orgs","repos_url":"https://api.github.com/users/dekellum/repos","events_url":"https://api.github.com/users/dekellum/events{/privacy}","received_events_url":"https://api.github.com/users/dekellum/received_events","type":"User","site_admin":false},"html_url":"https://github.com/dekellum/http","description":"Rust HTTP types","fork":true,"url":"https://api.github.com/repos/dekellum/http","forks_url":"https://api.github.com/repos/dekellum/http/forks","keys_url":"https://api.github.com/repos/dekellum/http/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dekellum/http/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dekellum/http/teams","hooks_url":"https://api.github.com/repos/dekellum/http/hooks","issue_events_url":"https://api.github.com/repos/dekellum/http/issues/events{/number}","events_url":"https://api.github.com/repos/dekellum/http/events","assignees_url":"https://api.github.com/repos/dekellum/http/assignees{/user}","branches_url":"https://api.github.com/repos/dekellum/http/branches{/branch}","tags_url":"https://api.github.com/repos/dekellum/http/tags","blobs_url":"https://api.github.com/repos/dekellum/http/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dekellum/http/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dekellum/http/git/refs{/sha}","trees_url":"https://api.github.com/repos/dekellum/http/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dekellum/http/statuses/{sha}","languages_url":"https://api.github.com/repos/dekellum/http/languages","stargazers_url":"https://api.github.com/repos/dekellum/http/stargazers","contributors_url":"https://api.github.com/repos/dekellum/http/contributors","subscribers_url":"https://api.github.com/repos/dekellum/http/subscribers","subscription_url":"https://api.github.com/repos/dekellum/http/subscription","commits_url":"https://api.github.com/repos/dekellum/http/commits{/sha}","git_commits_url":"https://api.github.com/repos/dekellum/http/git/commits{/sha}","comments_url":"https://api.github.com/repos/dekellum/http/comments{/number}","issue_comment_url":"https://api.github.com/repos/dekellum/http/issues/comments{/number}","contents_url":"https://api.github.com/repos/dekellum/http/contents/{+path}","compare_url":"https://api.github.com/repos/dekellum/http/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dekellum/http/merges","archive_url":"https://api.github.com/repos/dekellum/http/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dekellum/http/downloads","issues_url":"https://api.github.com/repos/dekellum/http/issues{/number}","pulls_url":"https://api.github.com/repos/dekellum/http/pulls{/number}","milestones_url":"https://api.github.com/repos/dekellum/http/milestones{/number}","notifications_url":"https://api.github.com/repos/dekellum/http/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dekellum/http/labels{/name}","releases_url":"https://api.github.com/repos/dekellum/http/releases{/id}","deployments_url":"https://api.github.com/repos/dekellum/http/deployments","created_at":"2018-09-17T20:43:24Z","updated_at":"2018-09-17T20:43:26Z","pushed_at":"2018-09-17T20:59:54Z","git_url":"git://github.com/dekellum/http.git","ssh_url":"git@github.com:dekellum/http.git","clone_url":"https://github.com/dekellum/http.git","svn_url":"https://github.com/dekellum/http","homepage":"","size":393,"stargazers_count":0,"watchers_count":0,"language":"Rust","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"hyperium:master","ref":"master","sha":"a1c3f4b920c64e0fd57582382c13aef78aa23de0","user":{"login":"hyperium","id":8730506,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg3MzA1MDY=","avatar_url":"https://avatars1.githubusercontent.com/u/8730506?v=4","gravatar_id":"","url":"https://api.github.com/users/hyperium","html_url":"https://github.com/hyperium","followers_url":"https://api.github.com/users/hyperium/followers","following_url":"https://api.github.com/users/hyperium/following{/other_user}","gists_url":"https://api.github.com/users/hyperium/gists{/gist_id}","starred_url":"https://api.github.com/users/hyperium/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hyperium/subscriptions","organizations_url":"https://api.github.com/users/hyperium/orgs","repos_url":"https://api.github.com/users/hyperium/repos","events_url":"https://api.github.com/users/hyperium/events{/privacy}","received_events_url":"https://api.github.com/users/hyperium/received_events","type":"Organization","site_admin":false},"repo":{"id":84983058,"node_id":"MDEwOlJlcG9zaXRvcnk4NDk4MzA1OA==","name":"http","full_name":"hyperium/http","private":false,"owner":{"login":"hyperium","id":8730506,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg3MzA1MDY=","avatar_url":"https://avatars1.githubusercontent.com/u/8730506?v=4","gravatar_id":"","url":"https://api.github.com/users/hyperium","html_url":"https://github.com/hyperium","followers_url":"https://api.github.com/users/hyperium/followers","following_url":"https://api.github.com/users/hyperium/following{/other_user}","gists_url":"https://api.github.com/users/hyperium/gists{/gist_id}","starred_url":"https://api.github.com/users/hyperium/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hyperium/subscriptions","organizations_url":"https://api.github.com/users/hyperium/orgs","repos_url":"https://api.github.com/users/hyperium/repos","events_url":"https://api.github.com/users/hyperium/events{/privacy}","received_events_url":"https://api.github.com/users/hyperium/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/hyperium/http","description":"Rust HTTP types","fork":false,"url":"https://api.github.com/repos/hyperium/http","forks_url":"https://api.github.com/repos/hyperium/http/forks","keys_url":"https://api.github.com/repos/hyperium/http/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hyperium/http/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hyperium/http/teams","hooks_url":"https://api.github.com/repos/hyperium/http/hooks","issue_events_url":"https://api.github.com/repos/hyperium/http/issues/events{/number}","events_url":"https://api.github.com/repos/hyperium/http/events","assignees_url":"https://api.github.com/repos/hyperium/http/assignees{/user}","branches_url":"https://api.github.com/repos/hyperium/http/branches{/branch}","tags_url":"https://api.github.com/repos/hyperium/http/tags","blobs_url":"https://api.github.com/repos/hyperium/http/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hyperium/http/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hyperium/http/git/refs{/sha}","trees_url":"https://api.github.com/repos/hyperium/http/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hyperium/http/statuses/{sha}","languages_url":"https://api.github.com/repos/hyperium/http/languages","stargazers_url":"https://api.github.com/repos/hyperium/http/stargazers","contributors_url":"https://api.github.com/repos/hyperium/http/contributors","subscribers_url":"https://api.github.com/repos/hyperium/http/subscribers","subscription_url":"https://api.github.com/repos/hyperium/http/subscription","commits_url":"https://api.github.com/repos/hyperium/http/commits{/sha}","git_commits_url":"https://api.github.com/repos/hyperium/http/git/commits{/sha}","comments_url":"https://api.github.com/repos/hyperium/http/comments{/number}","issue_comment_url":"https://api.github.com/repos/hyperium/http/issues/comments{/number}","contents_url":"https://api.github.com/repos/hyperium/http/contents/{+path}","compare_url":"https://api.github.com/repos/hyperium/http/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hyperium/http/merges","archive_url":"https://api.github.com/repos/hyperium/http/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hyperium/http/downloads","issues_url":"https://api.github.com/repos/hyperium/http/issues{/number}","pulls_url":"https://api.github.com/repos/hyperium/http/pulls{/number}","milestones_url":"https://api.github.com/repos/hyperium/http/milestones{/number}","notifications_url":"https://api.github.com/repos/hyperium/http/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hyperium/http/labels{/name}","releases_url":"https://api.github.com/repos/hyperium/http/releases{/id}","deployments_url":"https://api.github.com/repos/hyperium/http/deployments","created_at":"2017-03-14T18:21:23Z","updated_at":"2018-09-16T13:44:32Z","pushed_at":"2018-09-18T18:14:49Z","git_url":"git://github.com/hyperium/http.git","ssh_url":"git@github.com:hyperium/http.git","clone_url":"https://github.com/hyperium/http.git","svn_url":"https://github.com/hyperium/http","homepage":"","size":414,"stargazers_count":321,"watchers_count":321,"language":"Rust","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":42,"mirror_url":null,"archived":false,"open_issues_count":36,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":42,"open_issues":36,"watchers":321,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hyperium/http/pulls/253"},"html":{"href":"https://github.com/hyperium/http/pull/253"},"issue":{"href":"https://api.github.com/repos/hyperium/http/issues/253"},"comments":{"href":"https://api.github.com/repos/hyperium/http/issues/253/comments"},"review_comments":{"href":"https://api.github.com/repos/hyperium/http/pulls/253/comments"},"review_comment":{"href":"https://api.github.com/repos/hyperium/http/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hyperium/http/pulls/253/commits"},"statuses":{"href":"https://api.github.com/repos/hyperium/http/statuses/a3b41c98fb93a3e383a9d865a20dc706320ea6ae"}},"author_association":"NONE","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"seanmonstar","id":51479,"node_id":"MDQ6VXNlcjUxNDc5","avatar_url":"https://avatars1.githubusercontent.com/u/51479?v=4","gravatar_id":"","url":"https://api.github.com/users/seanmonstar","html_url":"https://github.com/seanmonstar","followers_url":"https://api.github.com/users/seanmonstar/followers","following_url":"https://api.github.com/users/seanmonstar/following{/other_user}","gists_url":"https://api.github.com/users/seanmonstar/gists{/gist_id}","starred_url":"https://api.github.com/users/seanmonstar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanmonstar/subscriptions","organizations_url":"https://api.github.com/users/seanmonstar/orgs","repos_url":"https://api.github.com/users/seanmonstar/repos","events_url":"https://api.github.com/users/seanmonstar/events{/privacy}","received_events_url":"https://api.github.com/users/seanmonstar/received_events","type":"User","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":2,"additions":26,"deletions":85,"changed_files":1}}
{"actor":{"display_login":"seanmonstar"}}