1197123 - percent encoding english alphabet characters in url are shown as english characters, but url doesn't work

Status: RESOLVED WONTFIX

(Core :: Networking, defect)

Description

[Michał]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0
Build ID: 20150811082003

Steps to reproduce:

When you replace english characters with % encoding the url wont work.
For example:
replace "o" in https://www.google.com/ with "%6f" (its "o" in percent encoding) 
you will get url like this: https://www.g%6f%6fgle.com/ 
paste it in url address, and go there
in url will be displayed https://www.google.com/, but you will get error "server not found".

Another example:
changed "k" into "%6b":
https://en.wikipedia.org/wiki/Percent-encoding
https://en.wikipedia.org/wi%6bi/Percent-encoding
wikipedia main page will appear instead of percent-encoding article.
When you change only last section of url, the wikipedia works fine:
https://en.wikipedia.org/wiki/Percent-enc%6fding

Chcecked how this works on IE, Chrome, Chrome on android, Opera and Firefox. Only Firefox have problems. Other browsers works fine.

Comment 1

[Gingerbread Man]

(In reply to Michał from comment #0)
> https://www.g%6f%6fgle.com/

Bug 309671.

> https://en.wikipedia.org/wi%6bi/Percent-encoding

I'm not sure about this. Marking as blocking bug 906714 to bring it to the attention of the right people.

Comment 2

[Junior [inactive]]

I've tested this in Firefox/47 and this issue no longer exists.
I believe it's a dup of bug 412457. How do you think, Valentin?

Comment 3

[Michał]

It's partially fixed.
https://www.g%6f%6fgle.com/ does work, but https://en.wikipedia.org/wi%6bi/Percent-encoding is leading to main page of wikipedia instead of https://en.wikipedia.org/wiki/Percent-encoding

Comment 4

[Junior [inactive]]

Okay, that's because Host is always un-escaped for IDN.
Need to know if we really need to unescaped English letters.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

As far as I can tell, the URL spec doesn't instruct to do percent decoding in the path [1] or query, but Chrome and Edge do so.
Anne, what should we do here?

[1] https://url.spec.whatwg.org/#path-state

Comment 6

[Anne (:annevk)]

I'm not sure, Safari does the same as us (and the standard). We could change it I suppose, but we'd have to investigate exactly what Chrome and Edge implement here.

Comment 7

[Junior [inactive]]

Any motivation or use case for percent encoding english alphabet in path/query...?

Comment 8

[Michał]

(In reply to Junior [:junior] from comment #7)
> Any motivation or use case for percent encoding english alphabet in
> path/query...?

You ask me for a set of beer?=]

It's useful as walkaround for badly implemented censor on forums, for tricking bots etc.
I'm thinking if there is a nasty way of using this, like showing replaced page with not changed url or giving a link to a page that work only with encoded character, but with normal doesn't.
I found this while trying to fake forum censor with link like "expertsexchange.com" ("sex" in string). I edited link and replaced s with % encoded character. For some people link worked, but for others it didn't. Would be nice to act the same for everyone.

Comment 9

[Valentin Gosu [:valentin] (he/him)]

I think we should actually change the behaviour, and unescape path&query too.
Opening file:///path/to/fil%65.txt actually works, because we do that just before opening the file path. It makes sense for us to do the same for regular http URLs.

Comment 10

[Anne (:annevk)]

It would make us different from Safari, but align with Chrome and Edge. That is probably okay and if you come up with a more detailed proposal (exactly which sequences we'd do this for) we might be able to convince Safari engineers to follow suit.

Comment 11

[Valentin Gosu [:valentin] (he/him)]

Upon discussion in https://github.com/whatwg/url/issues/87 it seems that we don't want to do this after all.