decodeURIComponent after parsing URL for initial connection

[kwanhs]

It appears the URL package is not decoding some special characters correctly. In my case, it was @ sign used in the password.
Regardless of whether @ or %40 (its encoded counterpart) is used, the attributes obtained from parsed URL is still %40.

[sidorares]

which version are you using? I'd expect this issue would be fixed by #1360

Can you double check the version you have is v2.3.0?

[kwanhs]

Thanks for your quick response! From my package.json: "mysql2": "^2.3.0"

[sidorares]

can you clarify the attributes obtained from parsed URL is still %40 part? Are you able to connect using url where password is urlencoded?

[kwanhs]

It was the password that remained url-encoded

[sidorares]

@acdibble should this line be password: unescape(parsedUrl.password) or something similar?

[acdibble]

We might have to pass both username and password to decodeURIComponent. However, if a password or username contains % and it is not properly escaped before building the URL, decodeURIComponent will throw an error, e.g.:

> password = 'pass!@$%^&*+()\\word:'
'pass!@$%^&*+()\\word:'
> conn = new URL(`test://user:${password}@www.example.com/path`)
URL {
  href: 'test://user:pass!%40$%%5E&*+()%5Cword%[email protected]/path',
  origin: 'null',
  protocol: 'test:',
  username: 'user',
  password: 'pass!%40$%%5E&*+()%5Cword%3A',
  host: 'www.example.com',
  hostname: 'www.example.com',
  port: '',
  pathname: '/path',
  search: '',
  searchParams: URLSearchParams {},
  hash: ''
}
> decodeURIComponent(conn.password)
Uncaught URIError: URI malformed
    at decodeURIComponent (<anonymous>)
> conn = new URL(`test://user:${encodeURIComponent(password)}@www.example.com/path`)
URL {
  href: 'test://user:pass!%40%24%25%5E%26*%2B()%5Cword%[email protected]/path',
  origin: 'null',
  protocol: 'test:',
  username: 'user',
  password: 'pass!%40%24%25%5E%26*%2B()%5Cword%3A',
  host: 'www.example.com',
  hostname: 'www.example.com',
  port: '',
  pathname: '/path',
  search: '',
  searchParams: URLSearchParams {},
  hash: ''
}
> decodeURIComponent(conn.password)
'pass!@$%^&*+()\\word:'

So possible errors would have to be handled here and properly reported to the users, or we could try/catch and use unescape or fallback to the raw password.

I can open a PR to fix it when we determine which solution we want to use.

[sidorares]

can we just use unescape straight away instead of having initial try using decodeURIComponent?

[sidorares]

(it's not just %, I think & in the password also triggers URI malformed ... error )