You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I see no direct way to add/edit/replace path components in a way that would ensure escaping, which seems unfortunate. If nothing else, quoting/escaping behavior needs to be very well documented, since it can be important to security (and certainly to functionality!).
It seems like the idea is that paths as passed to the constructor or a '/' operator are expected to be pre-urlencoded (but if anything unsafe does show up, it will be escaped -- IMHO this should raise an exception instead?). But, path parts as exposed in .parts and modified by .with_name() and .with_suffix() are the "underlying" unescaped values. However, there's no way to set an unescaped path, except by using urllib.parse.quote() yourself?
The text was updated successfully, but these errors were encountered:
It sort-of seems like urlpath will URL-encode non-URL-safe characters in URLs:
But, existing URL encoding is preserved, so I guess that was not a true escaping process?
Retrieving the path parts afterwards decodes the escapes:
That means taking a part and then re-appending it with '/' doesn't round-trip:
Using .with_name() does seem to escape fully:
I see no direct way to add/edit/replace path components in a way that would ensure escaping, which seems unfortunate. If nothing else, quoting/escaping behavior needs to be very well documented, since it can be important to security (and certainly to functionality!).
It seems like the idea is that paths as passed to the constructor or a '/' operator are expected to be pre-urlencoded (but if anything unsafe does show up, it will be escaped -- IMHO this should raise an exception instead?). But, path parts as exposed in .parts and modified by .with_name() and .with_suffix() are the "underlying" unescaped values. However, there's no way to set an unescaped path, except by using urllib.parse.quote() yourself?
The text was updated successfully, but these errors were encountered: