fxa/uritemplate-js — pull request #9 by RubenVerborgh (2013-01-21 12:45:43+00:00)
Title: Correctly encode percent signs in URIs

### Context
Suppose we have the following template:
```
/{?uri}
```
and the following variables:
```
uri := http://example.org/?ref=http%3A%2F%2Fother.org%2F
```
So note here that the `ref` parameter in the URI's string is equal to `http://other.org/` (URL encoded).

What we expect is that the expansion of this templates equals:
```
/?uri=http%3A%2F%2Fexample.org%2F%3Fref%3Dhttp%253A%252F%252Fother.org%252F
```
Note the double escaping for the `uri` parameter. This is logical, since decoding this parameter should result in the original variable value:
```
http://example.org/?ref=http%3A%2F%2Fother.org%2F
```

### Bug
However, with this library, the result is:
```
/?uri=http%3A%2F%2Fexample.org%2F%3Fref%3Dhttp%3A%2F%2Fother.org%2F
```
As you can see, percent signs are not encoded. This is incorrect, since [RFC6570](http://tools.ietf.org/html/rfc6570#section-3.2.1) reads:

> Note that the percent character ("%") is only allowed
> as part of a pct-encoded triplet and only for reserved/fragment
> expansion: in all other cases, a value character of "%" MUST be pct-
> encoded as "%25" by variable expansion

Furthermore, decoding becomes:
````
http://example.org/?ref=http://other.org/
```
which is different from the original value and thus wrong.

### Pull request
This pull request fixes this by:
- Adding `%` as a reserved character
- Fixing `LiteralExpression` to not decode the literal
- Fixing `encodingHelper` to not decode the literal