{"action":"created","issue":{"url":"https://api.github.com/repos/sporkmonger/addressable/issues/322","repository_url":"https://api.github.com/repos/sporkmonger/addressable","labels_url":"https://api.github.com/repos/sporkmonger/addressable/issues/322/labels{/name}","comments_url":"https://api.github.com/repos/sporkmonger/addressable/issues/322/comments","events_url":"https://api.github.com/repos/sporkmonger/addressable/issues/322/events","html_url":"https://github.com/sporkmonger/addressable/issues/322","id":370218918,"node_id":"MDU6SXNzdWUzNzAyMTg5MTg=","number":322,"title":"Applications must always unescape user and password","user":{"login":"nbibler","id":3775,"node_id":"MDQ6VXNlcjM3NzU=","avatar_url":"https://avatars0.githubusercontent.com/u/3775?v=4","gravatar_id":"","url":"https://api.github.com/users/nbibler","html_url":"https://github.com/nbibler","followers_url":"https://api.github.com/users/nbibler/followers","following_url":"https://api.github.com/users/nbibler/following{/other_user}","gists_url":"https://api.github.com/users/nbibler/gists{/gist_id}","starred_url":"https://api.github.com/users/nbibler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbibler/subscriptions","organizations_url":"https://api.github.com/users/nbibler/orgs","repos_url":"https://api.github.com/users/nbibler/repos","events_url":"https://api.github.com/users/nbibler/events{/privacy}","received_events_url":"https://api.github.com/users/nbibler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-15T15:29:44Z","updated_at":"2018-10-18T00:00:32Z","closed_at":null,"author_association":"NONE","body":"I saw some discussion around this in #42. Is it the intended behavior that Addressable does not automatically unescape user and password values?\r\n\r\n```ruby\r\n>> uri = Addressable::URI.parse('http://test.url/')\r\n=> #<Addressable::URI:0x3ff17d8a7628 URI:http://test.url/>\r\n>> uri.user = 'us+er'\r\n=> \"us+er\"\r\n>> uri.password = 'pas wo/d='\r\n=> \"pas wo/d=\"\r\n>> uri.normalize!\r\n=> #<Addressable::URI:0x3ff17d8a7628 URI:http://us%2Ber:pas%20wo%2Fd%3D@test.url/>\r\n>> uri.user\r\n=> \"us%2Ber\"\r\n>> uri.password\r\n=> \"pas%20wo%2Fd%3D\"\r\n```\r\n\r\nThis would functionally require that applications using Addressable should always unescape the user and password values before use (for example Faraday has a [`basic_auth` middleware](https://github.com/lostisland/faraday#authentication) which need to be populated with these values at construction):\r\n\r\n```ruby\r\n>> uri = Addressable::URI.parse('http://us%2Ber:pas%20wo%2Fd%3D@test.url/')\r\n=> #<Addressable::URI:0x3ff17d504020 URI:http://us%2Ber:pas%20wo%2Fd%3D@test.url/>\r\n>> user = CGI.unescape(uri.user)\r\n=> \"us+er\"\r\n>> password = CGI.unescape(uri.password)\r\n=> \"pas wo/d=\"\r\n```\r\n\r\nSimply taking the `uri.user` or `uri.password` will not work, since they are escaped and incorrect if used directly.\r\n\r\nPart of this question stems from inconsistency with Addressable's behavior around `query_values` which are unescaped when queried:\r\n\r\n```ruby\r\n>> uri = Addressable::URI.parse('https://host.url/?test=b%3Dd')\r\n=> #<Addressable::URI:0x3ff17d4c0460 URI:https://host.url/?test=b%3Dd>\r\n>> uri.query_values\r\n=> {\"test\"=>\"b=d\"}\r\n>> uri.query_values['test']\r\n=> \"b=d\"\r\n```"},"comment":{"url":"https://api.github.com/repos/sporkmonger/addressable/issues/comments/430829842","html_url":"https://github.com/sporkmonger/addressable/issues/322#issuecomment-430829842","issue_url":"https://api.github.com/repos/sporkmonger/addressable/issues/322","id":430829842,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDgyOTg0Mg==","user":{"login":"sporkmonger","id":1778,"node_id":"MDQ6VXNlcjE3Nzg=","avatar_url":"https://avatars0.githubusercontent.com/u/1778?v=4","gravatar_id":"","url":"https://api.github.com/users/sporkmonger","html_url":"https://github.com/sporkmonger","followers_url":"https://api.github.com/users/sporkmonger/followers","following_url":"https://api.github.com/users/sporkmonger/following{/other_user}","gists_url":"https://api.github.com/users/sporkmonger/gists{/gist_id}","starred_url":"https://api.github.com/users/sporkmonger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sporkmonger/subscriptions","organizations_url":"https://api.github.com/users/sporkmonger/orgs","repos_url":"https://api.github.com/users/sporkmonger/repos","events_url":"https://api.github.com/users/sporkmonger/events{/privacy}","received_events_url":"https://api.github.com/users/sporkmonger/received_events","type":"User","site_admin":false},"created_at":"2018-10-18T00:00:32Z","updated_at":"2018-10-18T00:00:32Z","author_association":"OWNER","body":"`query_values` is sort of special though as it's more of a view on top of `query`. I'm more concerned about consistency with more typical accessors like `query` or `path`."}}
{"actor":{"display_login":"sporkmonger"}}