space outside of parameters are not allowed in path() routes

[Kevin Michel]

To avoid ambiguities in parameter names, space were forbidden from path routes in #29667 .

However, the fix in ​https://github.com/django/django/pull/11688 forbids space anywhere,
including outside of <> parameters.

Urls with spaces are weird and subject to url encoding in the browser bar, but they appear
occasionally, I hit the bug with a real url after migrating to 3.1.

re_path allows matching those urls as a workaround but it's weird to have to use re just
because of a space in an otherwise simple route.

If the bug is deemed valid, I can work on a patch to only forbid spaces between < and > parts.

[Carlton Gibson]

Hi Kevin. Thanks for the report, but I don't think we should support this.

​RFC 1738 is pretty clear on this:

The space character is unsafe ....

and:

...All unsafe characters must always be encoded within a URL.

(Search for the "unsafe" section header.)

I think "If you want to do this nonetheless then use re_path" is more than reasonable.

[Kevin Michel]

Hi,

I agree that spaces in URLs are unsafe, and we should urlencode them
when transmitting or writing URLs, like the browser does automatically.

However, URLs are urldecoded before reaching the router (which is the
right thing to do as far as I understand it), the router matches a decoded
path, which is not really an URL anymore.

In the WSGI case, the url decoding is done when filling environ['PATH_INFO'],
for instance here: ​https://github.com/python/cpython/blob/master/Lib/wsgiref/simple_server.py#L85

Because of that, it's not possible to try to match the safe "%20" in a route
as if it was an URL.

I think spaces in URLs are indeed unsafe and invalid but spaces in the
path for the router are safe and should be allowed.

Not being able to match all valid paths with a route is a possibility but it's
a bit surprising.

[Carlton Gibson]

Yes, you're right. The ​CGI spec has:

Unlike a URI path, the PATH_INFO is not URL-encoded

Thanks!

[Tim Park]

Hey guys, PR opened here: ​https://github.com/django/django/pull/13364

Let me know your thoughts!

[Mariusz Felisiak <felisiak.mariusz@…>]

In ece1820:

Fixed #31858 -- Reallowed whitespaces in URL paths outside of parameters.

Regression in 22394bd3a18a7d9a8957a0b431f8ae4e5ca03a8c.

Thanks David Smith for the review.