Skip to content

fix(tree): use url.PathUnescape for path parameters#4674

Open
baltasarblanco wants to merge 1 commit into
gin-gonic:masterfrom
baltasarblanco:fix/3850-use-pathunescape-for-path-params
Open

fix(tree): use url.PathUnescape for path parameters#4674
baltasarblanco wants to merge 1 commit into
gin-gonic:masterfrom
baltasarblanco:fix/3850-use-pathunescape-for-path-params

Conversation

@baltasarblanco
Copy link
Copy Markdown

Pull Request Checklist

Please ensure your pull request meets the following requirements:

  • Open your pull request against the master branch.
  • All tests pass in available continuous integration systems (e.g., GitHub Actions).
  • Tests are added or modified as needed to cover code changes.
  • If the pull request introduces a new feature, the feature is documented in the docs/doc.md.

Description

Replace url.QueryUnescape with url.PathUnescape when decoding wildcard parameter values in the radix tree. Per RFC 3986, URL path segments preserve + as a literal character; the + → space convention belongs to application/x-www-form-urlencoded, not to URL paths. This aligns Gin with the upstream httprouter and Go stdlib semantics.

Scope of impact

Affects only configurations using UseEscapedPath or UseRawPath together with UnescapePathValues=true. The default routing path is unchanged because URL.Path is already decoded by net/http upstream of getValue, so unescape is false and neither function is invoked.

Behavior change (called out explicitly)

A URL path param containing a literal + (e.g. /items/a+b) previously decoded to a b; it now correctly decodes to a+b. Percent-encoded + (%2B) still decodes to +. Clients needing a space in a path segment should URL-encode it as %20 (RFC 3986).

Tests

  • Two cases in TestUnescapeParameters previously asserted the incorrect + → space behavior and have been updated.
  • A new case verifies that %2B still decodes to +.
  • Full matrix passes locally: default, -race, -tags=nomsgpack, -tags=go_json, -tags=sonic (with --ldflags="-checklinkname=0").

Fixes #3850

Replace url.QueryUnescape with url.PathUnescape when decoding
wildcard parameter values in the radix tree. Per RFC 3986, URL
path segments preserve '+' as a literal character; the '+' to
space convention belongs to application/x-www-form-urlencoded,
not to URL paths.

The change affects only configurations using UseEscapedPath or
UseRawPath together with UnescapePathValues=true. The default
routing path is unchanged because URL.Path is already decoded
by net/http upstream of getValue.

Two existing test cases in TestUnescapeParameters previously
asserted the incorrect '+' to space behavior and have been
updated. A new test case verifies that '%2B' (percent-encoded
'+') still decodes to '+'.

Fixes gin-gonic#3850
@codecov
Copy link
Copy Markdown

codecov Bot commented May 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.37%. Comparing base (3dc1cd6) to head (4f17499).
⚠️ Report is 276 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4674      +/-   ##
==========================================
- Coverage   99.21%   98.37%   -0.84%     
==========================================
  Files          42       48       +6     
  Lines        3182     3138      -44     
==========================================
- Hits         3157     3087      -70     
- Misses         17       42      +25     
- Partials        8        9       +1     
Flag Coverage Δ
?
--ldflags="-checklinkname=0" -tags sonic 98.36% <100.00%> (?)
-tags go_json 98.29% <100.00%> (?)
-tags nomsgpack 98.35% <100.00%> (?)
go-1.18 ?
go-1.19 ?
go-1.20 ?
go-1.21 ?
go-1.25 98.37% <100.00%> (?)
go-1.26 98.37% <100.00%> (?)
macos-latest 98.37% <100.00%> (-0.84%) ⬇️
ubuntu-latest 98.37% <100.00%> (-0.84%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Should we use url.PathUnescape instead of url.QueryUnescape when UnescapePathValues is true

1 participant