forwardemail / forwardemail/superagent

Incorrect encoding of characters in query parameters

Open
#686 2 comments 3 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
16.6k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

Superagent runs `encodeURIComponent` on all query keys. However, [RFC3986](http://tools.ietf.org/html/rfc3986#section-2.2) defines a number of characters (sub-delims) which may be used unencoded in the query part of a url, including comma and a few more like `+'!$()*;`.

This means you can't use superagent to query a valid url like `/id?key=val1,val2`.

It also means superagent is incompatible with a lot of other url software like curl, chrome, python-requests and npm request.

This should be documented. Ideally, superagent should leave encoding to the user, although this would be a breaking change. Or, have an option to disable encoding.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.