forwardemail / forwardemail/superagent
Incorrect encoding of characters in query parameters
- Dominant language
- JavaScript
- Stars
- 16.6k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
Superagent runs `encodeURIComponent` on all query keys. However, [RFC3986](http://tools.ietf.org/html/rfc3986#section-2.2) defines a number of characters (sub-delims) which may be used unencoded in the query part of a url, including comma and a few more like `+'!$()*;`.
This means you can't use superagent to query a valid url like `/id?key=val1,val2`.
It also means superagent is incompatible with a lot of other url software like curl, chrome, python-requests and npm request.
This should be documented. Ideally, superagent should leave encoding to the user, although this would be a breaking change. Or, have an option to disable encoding.
Contributor guide
Assessment
This issue has not been assessed yet.