[Zope3-checkins] SVN: Zope3/trunk/src/zope/app/apidoc/utilitymodule/ Fixed utility module to work well with any type of utility name.

[Bjorn Tillenius]

On Sat, Oct 29, 2005 at 09:33:54AM -0400, Stephan Richter wrote:
> On Saturday 29 October 2005 09:01, Bjorn Tillenius wrote:
> > Maybe I've missed some aspect of the problem, but it seems strange that
> > you chose to use BASE64, thus producing very cryptic URLs, which aren't
> > readable at all. If the problem is that you want to use the names in
> > URLs, why not use urllib.quote() whenever you construct a URL?
> >
> > Since ILocation.__name__ is a TextLine, thus allow the names to contain
> > almost any characters, I can name my utility:
> >
> >     "Is this name url safe??? Let's see."
> >
> > Now, let's encode it with BASE64:
> >
> >     >>> "Is this name url safe??? Let's see.".encode('base64')
> >     'SXMgdGhpcyBuYW1lIHVybCBzYWZlPz8/IExldCdzIHNlZS4=\n'
> >
> > As you can see, there's a '/' character in there, thus the traverser
> > will think that the utility name is 'SXMgdGhpcyBuYW1lIHVybCBzYWZlPz8'.
> 
> Thank you very much for pointing this out!
> 
> > So it seems like you have to use urllib.quote() anyway.
> 
> This does not work. I tried urllib.quote_plus() first, but some browsers 
> decode this output before sending it to the browser. so it is no good. I 
> could mask the quoted string, but it seemed dangerous too.

Can you give an example of a browser that does this? I'd like to try it
out for myself, to see what's wrong. If this indeed is the case, it's a
major browser bug, and should be fixed.

BTW, urllib.quote_plus() should be used only for quoting strings that
are to be included in the query part of the URL, not in the path part.

> > I haven't looked into the problem you're trying to solve, though, so
> > maybe I'm missing something. Just wanted to raise a possible issue. And
> > I dislike cryptic URLs. ;)
> 
> I hate them too! Very much! If I can get a better solution, please let me 
> know. Basically, I have random unicode strings and need to make a URL-safe 
> representation.

The standard way is to encode the string using utf-8, and then url quote
it. If that doesn't work in some browser, I think those browsers should
be fixed. All names in Zope3 are by default allowed to be practically
any unicode string and can appear in a URL, so this problem isn't local
to apidoc's utility module.

Regards,

Bjorn