websockets / ws / 42104535460

100%

push

github

[fix] Percent-decode the userinfo of the URL (#2352)

The URL parser keeps the username and password percent-encoded, and they
were used as they are to build the `Authorization` header, so
`ws://user:p%40ss@host` sent the password `p%40ss`.

Decode them with `querystring.unescape()`, like `http.request()` does.
Unlike `decodeURIComponent()` it leaves malformed sequences as they are,
so a password such as `100%` keeps working.

1148 of 1154 branches covered (99.48%)

4 of 4 new or added lines in 1 file covered. (100.0%)

1679 of 1680 relevant lines covered (99.94%)

29172.48 hits per line