aio-libs / yarl / 40577229866

98%

push

github

Encode the userinfo as WHATWG does in WHATWG mode (#2002)

<!-- Thank you for your contribution! -->

## What do these changes do?

In WHATWG mode the userinfo is now split and encoded as the WHATWG URL
Standard does. The userinfo goes up to the last `@`, so `[` and `]` in
it are no longer taken for an IP-literal (`http://&a:foo(b]c@d:2/` used
to fail with "Invalid IPv6 URL"), and a scheme that is not special keeps
`\` there, percent-encoded. The username and the password are encoded
with the userinfo percent-encode set: `;` and `=` are now
percent-encoded, while `%` and percent-encoded octets are kept as
written. `URL.build()`, `with_user()`, `with_password()` and a change of
mode into WHATWG mode encode `;` and `=` the same way.

RFC mode is unchanged and still rejects these URLs. A special scheme
still rejects `\` in an `encoded=True` authority, since WHATWG reads it
as `/` there.

## Are there changes in behavior for the user?

Yes, in WHATWG mode only. `URL("http://a;b@h/")` is now
`http://a%3Bb@h/`, `http://a%b@h/` keeps `a%b` instead of `a%25b`, and
`http://a%41@h/` keeps `a%41` instead of decoding it to `aA`. These
match Node's `URL`. The decoded `user` and `password` are the same as
before.

## Is it a substantial burden for the maintainers to support this?

No. The parser change is a regex substitution on the userinfo in WHATWG
mode; the builders add a check for `;` and `=` after the existing
quoter.

## Related issue number

N/A

## Checklist

- [x] I think the code is well written
- [x] Unit tests for the changes exist
- [x] Documentation reflects the changes
- [ ] If you provide code modification, please add yourself to
`CONTRIBUTORS.txt`
- [x] Add a new news fragment into the `CHANGES/` folder

Drafted with Claude Code (Claude Opus 5.5); reviewed by @asvetlov.

<details>
<summary>Agent run details (optional, for reviewers)</summary>

Tests: `pytest tests -n 8`: 3689 passed, 44 xfailed; with
`YARL_NO_EXTENSIONS=1`: 3306 passed, 7 skipped,... (continued)

97 of 194 branches covered (50.0%)

Branch coverage included in aggregate %.

164 of 164 new or added lines in 6 files covered. (100.0%)

11754 of 11904 relevant lines covered (98.74%)

0.99 hits per line