Escape a Little Less

[chrisoverzero]

Issue Number

#440

Description of Changes

Double-escapes '%2F' so that it survives unescaping by WebUtility.UrlDecode. This matches other implementations better, and allows path parameters containing '%2F' (or '%2f', natch) to be routed correctly by ASP.NET Core. If someone suggests a smarter solution, I'll accept it happily. (Also some smaller changes, hopefully uncontroversial, all in a separate commit.)

License Acceptance

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. ✔️

[normj]

Thanks for the PR. Would you mind providing some example resource paths to the conversation? I'll add some test cases.

[chrisoverzero]

Oh, yes. Of course.

Given the routes:

• [HttpGet("{first}/{second}", Name = "Multi")]
• [HttpGet("{only}", Name = "Single")]

…in a TestsController:

• /tests/a/b should route to "Multi"
  • with first = "a", second = "b"
  • which is a regression check
• /tests/a%2Fb should route to "Single"
  • with only = "a%2Fb"
  • where routing to "Multi" is an error
• /tests/a%2fb should route to "Single"
  • with only = "a%2fb"
  • where routing to "Multi" is an error

(Doing this from memory on a tablet, so please forgive minor errors.)

[normj]

I was trying those resource paths using on a regular ASP.NET Core running on Kestrel and I'm seeing the results go into"Multi" request handler. Am I missing something?

[chrisoverzero]

I can't recreate your results. From a fresh dotnet new webapi project, with this controller:

[Route("api/[controller]"), ApiController]
public class ValuesController : ControllerBase
{
    [HttpGet("{first}/{second}", Name = "Multi")]
    public ActionResult Multi(string first, string second) => Ok(new { first, second });

    [HttpGet("{only}", Name = "Single")]
    public ActionResult Single(string only) => Ok(new { only });
}

I get this:

cosborn@DEVCOSBORN1 MINGW64 /d/vp/routing-test
$ curl -sS 'http://localhost:5000/api/values/a/b'
{"first":"a","second":"b"}
cosborn@DEVCOSBORN1 MINGW64 /d/vp/routing-test
$ curl -sS 'http://localhost:5000/api/values/a%2Fb'
{"only":"a%2Fb"}

Gimme a few, and I'll get this into a git cloneable place.

[chrisoverzero]

Here we go: https://github.com/chrisoverzero/routing-test

[normj]

I figured out why I wasn't seeing the same behavior as you. If you run the ASP.NET Core behind IIS Express you get different behavior then just running it standalone through kestrel.

[normj]

This has been merged into the dev branch 0965c3b

I'll chime back here when the change is released.

[normj]

Version 3.0.4 is released with this PR. Thanks for the PR!