No distinction made between empty query string and undefined query string
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 215
- Avg merge
- 1d 2m
- Merged PRs (30d)
- 13
Description
The problem is illustrated by the following example:
```
>>> from yarl import URL
>>> URL('/stuff?')
URL('/stuff')
>>> URL('/stuff')
URL('/stuff')
```
[RFC 3986](https://tools.ietf.org/html/rfc3986) defines a query string using the following BNF:
```
query = *( pchar / "/" / "?" )
```
The distinction between an undefined query and an empty query is based solely on the presence of the '?' delimiter. `yarl` doesn't make that distinction, which means that libraries that make use of `yarl` (e.g. `aiohttp`) may also not provide a way to make that distinction.
The lack of distinction can be problematic in cases where there's a dependency on the exact representation of the URL. For example, if an HTTP client sends a request and includes a cryptographic hash that takes the representation of the request target (path and query) into account, and the HTTP server sees a request target that does not include a '?' and attempts to authenticate the hash using the request target, then authentication will fail.
Contributor guide
Assessment
This issue has not been assessed yet.