idan/oauthlib — pull request #127 by ayanamist (2013-03-23 18:05:59+00:00)
Title: Avoid escape string twice.

Current design will escape string twice.
If we use `status=%E5%95%A6%E5%95%A6` as post body input, `Request.__init__` will make it `u"status=%E5%95%A6%E5%95%A6"`,
then `oauth1.rfc5849.signature.collect_parameters()` will call `bodyparams = extract_params(body) or []`,
then call `common.urldecode()`,
then call `urlparse.parse_qsl(query, keep_blank_values=True)`.
Here, `u"status=%E5%95%A6%E5%95%A6"` will become `[(u'status', u'\xe5\x95\xa6\xe5\x95\xa6')]`, now troubles comes in because `u'\xe5\x95\xa6\xe5\x95\xa6'` is a problematic unicode string.
When normalizing it, it will be utf8-encoded again (from `common.quote` called by `oauth1.rfc5849.utils.escape`) and become `'\xc3\xa5\xc2\x95\xc2\xa6\xc3\xa5\xc2\x95\xc2\xa6'`.
Now everything messed up, and calculated signature is wrong.

So we must abandan unnecessary body encode because body in unicode only cause problem, also we should remove `query = query.decode('utf-8') if isinstance(query, bytes_type) else query` to keep our `str` result away from converting to `unicode`. `decode_params_utf8` will decode the `str` result to correct one, and make the final calculation right.

The issue is not obvious because english words only use ascii characters which are safe after multple escaping.