python / python/cpython

`urllib.parse.parse_qsl` is accepting illegal characters

Open
#138,284 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

urllib.parse.parse_qsl parses query strings containing the ^ and ` characters, even though these are not valid query characters under RFC 3986.

Observed behaviour:

parse_qsl('foo=^', strict_parsing=True)
# [('foo', '^')]

parse_qsl('bar=`', strict_parsing=True)
# [('bar', '`')]

Expected behaviour:
According to RFC 3986, both ^ and ` must be percent-encoded if used in a URI. However, parse_qsl accepts them as-is without raising an error or warning. This could lead to applications treating invalid URLs as valid.

Detailed Code:

import sys
import platform
from urllib.parse import parse_qsl


def test_parse_qsl(query):
    try:
        result = parse_qsl(query, strict_parsing=True)
        print(f"Query: {query!r} -> Parsed: {result}")
    except ValueError as e:
        print(f"Query: {query!r} -> Error: {e}")


# Test invalid query strings
test_parse_qsl("foo=^")
test_parse_qsl("bar=`")

# System information
os_name = platform.system()
os_release = platform.release()
python_impl = platform.python_implementation() 
python_version = sys.version.split()[0]
python_compiler = platform.python_compiler() 

print("\n--- System Information ---")
print(f"Python Implementation : {python_impl}")
print(f"Python Version : {python_version}")
print(f"Python Compiler       : {python_compiler}")
print(f"Operating System : {os_name} {os_release}")
print(f"Machine         : {platform.machine()}")

# Output:
# Query: 'foo=^' -> Parsed: [('foo', '^')]
# Query: 'bar=`' -> Parsed: [('bar', '`')]

# --- System Information ---
# Python Implementation : CPython
# Python Version : 3.13.1
# Python Compiler       : GCC 14.2.0
# Operating System : Linux 4.14.174
# Machine         : x86_64

References:

  1. Section 2.2 Reserved Characters: https://datatracker.ietf.org/doc/html/rfc3986#section-2.2

  2. Section 2.3 Unreserved Characters: https://datatracker.ietf.org/doc/html/rfc3986#section-2.3

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Linked PRs
  • gh-138291

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the urllib.parse.parse_qsl entry point and compare its current behavior with RFC 3986 sections 2.2 and 2.3. Review the existing urllib.parse tests, then verify that queries containing unencoded ^ and ` are handled as specified and that regression coverage captures the expected behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.