From: "NARUSE, Yui" <naruse@...>
Date: 2010-04-09T10:48:50+09:00
Subject: [ruby-core:29370] Re: URI.(un)escape deprecated?

> So, Yui, could you please tell us what motivated this change and what
> we are supposed to use instead? No reference is given in r24773

This is itroduced by the thread from [ruby-dev:38005]. (sorry for missing refs)
http://blade.nagaokaut.ac.jp/cgi-bin/vframe.rb/ruby/ruby-dev/39254?37896-39341+split-mode-vertical

In the thread we thought what is the use case of URI.encode,
and we concluded there is no use case.

That is because what URI.encode does is escaping other than reserved
and unreserved.
 mark          = "-" | "_" | "." | "!" | "~" | "*" | "'" |
                 "(" | ")"
 unreserved    = alphanum | mark
 reserved      = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" |
                 "$" | "," | "[" | "]"
This means URI.encode escapes characters which shouldn't appear.
But what is expected argument?

Rdoc of URI.encode shows following example:
   enc_uri = URI.escape("http://example.com/?a=\11\15")
   p enc_uri
   # => "http://example.com/?a=%09%0D"

But real implementation should be:
   enc_uri = URI.escape("http://example.com/?a=#{argument}")
   p enc_uri
   # => "http://example.com/?a=%09%0D"

You know, this implementation has a vulnerability that
argument can be "foo&extra=some_command".

So we concluded URI.encode is wrong and deprecated.

> What are we supposed to use instead?

Following will be the candidate.
* CGI.escape
* URI.www_form_encode
* URI.www_form_encode_component

If they are not what you want, please tell me.

-- 
NARUSE, Yui
naruse@airemix.jp