mitsuhiko/werkzeug — pull request #517 by badmetacoder (2014-04-24 21:02:01+00:00)
Title: Disable implicit reconstruction of a URL into an IRI.

Proposed changes modify calls to `get_current_url()` while preserving its current default behaviour for the time being. The current implementation of `get_current_url()` reassembles the original URI into its IRI representation and sets the value of the `url` property of a request object to a Unicode string that represents a decoded version of the original percent-encoded URI, for example:

Original URI found in a request received by Werkzeug:

http://example.com?name=%C3%A9

The IRI returned by get_current_url():

http://example.com?name=é

Such URIs break other modules that do not consume non-percent-encoded IRIs.

This goes against the following guidance found in RFC 2718 and RFC 3986:

"Unless there is some compelling reason for a particular scheme to do otherwise, translating character sequences into UTF-8 (RFC 2279) [3] and then subsequently using the %HH encoding for unsafe octets is recommended." (RFC 2718)

"Non-ASCII characters must first be encoded according to UTF-8 [STD63], and then each octet of the corresponding UTF-8 sequence must be percent-encoded to be represented as URI characters." (RFC 3986)

While RFC 3987 defines a standard for IRIs, its authors write in section "3.2. Converting URIs to IRIs":

"In some situations, converting a URI into an equivalent IRI may be desirable." (RFC 3987)

There is no mention of a requirement to convert percent-encoded URIs into IRIs, and RFC 3987 does not obsolete other standards related to URIs.

While IRIs and percent-encoded URIs represent the same resource, they are not the same. While the encoding standard proposed in RFC 3987 seems to be well-suited for the visual representation of URIs that contain non-ASCII characters, requests that use IRI break other components that expect percent-encoded URIs.

I would like to propose an interim modification to the code that sets the `url` property to a percent-encoded URI instead of a Unicode IRI. Long-term, it might be beneficial to add an `iri` property to BaseRequest and set it to the IRI representation of the original URI.