aio-libs / aio-libs/yarl

No distinction made between empty query string and undefined query string

Open
#293 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
1.5k
Forks
215
Avg merge
1d 2m
Merged PRs (30d)
13

Description

The problem is illustrated by the following example:
```
>>> from yarl import URL
>>> URL('/stuff?')
URL('/stuff')
>>> URL('/stuff')
URL('/stuff')
```
[RFC 3986](https://tools.ietf.org/html/rfc3986) defines a query string using the following BNF:
```
query = *( pchar / "/" / "?" )
```
The distinction between an undefined query and an empty query is based solely on the presence of the '?' delimiter. `yarl` doesn't make that distinction, which means that libraries that make use of `yarl` (e.g. `aiohttp`) may also not provide a way to make that distinction.

The lack of distinction can be problematic in cases where there's a dependency on the exact representation of the URL. For example, if an HTTP client sends a request and includes a cryptographic hash that takes the representation of the request target (path and query) into account, and the HTTP server sees a request target that does not include a '?' and attempts to authenticate the hash using the request target, then authentication will fail.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.