Fix double decoding of URL query values - #4209
Open
winklemad wants to merge 1 commit into
Open
Conversation
Sanjays2402
reviewed
Jul 26, 2026
| for name, value in parse_qs(url.query).items(): | ||
| if value and len(value) > 0: | ||
| value = unquote(value[0]) | ||
| value = value[0] |
Contributor
There was a problem hiding this comment.
this contradicts the from_url docstrings, which state "The username, password, hostname, path and all querystring values are passed through urllib.parse.unquote". Same text lives in client.py:185, cluster.py:660, asyncio/client.py:172 and asyncio/cluster.py:344, so all four need the querystring part dropped or this becomes an undocumented behavior change for anyone who double-encoded on purpose.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of change
urllib.parse.parse_qsalready percent-decodes query values. Both the sync andasync URL parsers subsequently called
unquoteon those values, causingdoubly encoded data such as
%2520to become a space instead of the literal%20.Remove the redundant second decoding step in both implementations and add
mirrored sync/async regression tests proving query values are decoded exactly
once.
Fixes #4208
Pull Request check-list
Please make sure to review and check all of these items:
changed files, and full Vulture pass.
files on
master.NOTE: these things are not required to open a PR and can be done
afterwards / while the PR is open.
Note
Low Risk
Small, localized URL parsing fix with mirrored tests; no auth or API surface changes beyond correct query string values.
Overview
Fixes double percent-decoding of connection URL query parameters in sync and async
parse_urlby dropping an extraunquote()on values returned fromparse_qs, which already decodes them once.Values like
client_name=worker%2520namenow become the literalworker%20nameinstead ofworker name. Username, password, path, and host handling are unchanged and still useunquotewhere appropriate.Adds matching sync/async pool tests (
test_querystring_values_are_decoded_once) to lock in single-decode behavior (fixes #4208).Reviewed by Cursor Bugbot for commit 6a5dbf3. Bugbot is set up for automated code reviews on this repo. Configure here.