Uploaded image for project: 'OASIS Open Data Protocol (OData) TC'
  1. OASIS Open Data Protocol (OData) TC
  2. ODATA-1539

Clarify decoding of plus character in URLs

    XMLWordPrintable

    Details

    • Proposal:
      Hide

      Rephrase second part of 2.1 URL Parsing:

      After applying these steps defined by [RFC3986] the following steps MUST be performed:

      • Split undecoded query at "&" (octet 0x26) into query options, and each query option at the first "=" (octet 0x3D) into query option name and query option value
      • Percent-decode path segments, query option names, and query option values exactly once
      • Interpret path segments, query option names, and query option values according to OData rules

      Note: neither [RFC3986] nor this specification assign special meaning to "+" (octet 0x2B). Some implementations decode "+" (octet 0x2B) as space (octet 0x20), others take it literally. Clients are advised to percent-encode space (octet 0x20) as %20 and "+" (octet 0x2B) as %2B and avoid the ambiguous "+" (octet 0x2B) in URLs.

       

      This is all we can do in Errata, follow-up action is ODATA-1540.

      Show
      Rephrase second part of 2.1 URL Parsing : After applying these steps defined by [ RFC3986 ] the following steps MUST be performed: Split undecoded query at "&" (octet 0x26) into query options, and each query option at the first "=" (octet 0x3D) into query option name and query option value Percent-decode path segments, query option names, and query option values exactly once Interpret path segments, query option names, and query option values according to OData rules Note: neither [RFC3986]  nor this specification assign special meaning to "+" (octet 0x2B). Some implementations decode "+" (octet 0x2B) as space (octet 0x20), others take it literally. Clients are advised to percent-encode space (octet 0x20) as %20 and "+" (octet 0x2B) as %2B and avoid the ambiguous "+" (octet 0x2B) in URLs.   This is all we can do in Errata, follow-up action is ODATA-1540 .
    • Resolution:
      Hide

      https://github.com/oasis-tcs/odata-specs/pull/152

      Show
      https://github.com/oasis-tcs/odata-specs/pull/152

      Description

      OData URL is based on RFC3986, which in Section 2.1 Percent-Encoding explicitly defines %20 as the encoding for space.

      Unfortunately RFC3986 is less clear on the encoding of the plus (+) character: Section 2.2 Reserved Characters recommends %2B as the encoding for plus “unless […] specifically allowed by the URI scheme to represent data in that component”.

      As a consequence, many URL-encoding tools, and the most commonly used browsers (Chrome, Edge, Firefox) do not percent-encode the plus character and retain it as a plus character.

      To make matters really confusing the WhatWG URL specification defines an API for manipulating URLs that - depending on how it is used - will encode space as the the plus (+) character:

      var x = new URL("http://foo?bar=a+b c")
x.href // --> http://foo/?bar=a+b%20c

var y = new URL("http://foo")
y.searchParams.append("bar","a+b c")
y.href // --> http://foo/?bar=a%2Bb+c

       
      This raises the question on how an OData service SHOULD / MUST interpret the plus (+) character in a URL:

      • does it mean plus,
      • or does it mean space?

      Note: the percent-encoded variants are unambiguous:

      • %20 means space
      • %2B means plus
         

       

       

        Attachments

          Activity

            People

            • Assignee:
              handl Ralf Handl
              Reporter:
              handl Ralf Handl
            • Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: