use EscapedPath for URL handling

mux.go

@@ -110,7 +110,7 @@ func New() *PatternServeMux {
 // described above.
 func (p *PatternServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	for _, ph := range p.handlers[r.Method] {
-		if params, ok := ph.try(r.URL.Path); ok {
+		if params, ok := ph.try(r.URL.EscapedPath()); ok {
 			if len(params) > 0 && !ph.redirect {
 				r.URL.RawQuery = url.Values(params).Encode() + "&" + r.URL.RawQuery
 			}
@@ -131,7 +131,7 @@ func (p *PatternServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 
 		for _, ph := range handlers {
-			if _, ok := ph.try(r.URL.Path); ok {
+			if _, ok := ph.try(r.URL.EscapedPath()); ok {
 				allowed = append(allowed, meth)
 			}
 		}
@@ -266,7 +266,11 @@ func (ph *patHandler) try(path string) (url.Values, bool) {
 			var nextc byte
 			name, nextc, j = match(ph.pat, isAlnum, j+1)
 			val, _, i = match(path, matchPart(nextc), i)
-			p.Add(":"+name, val)
+			escval, err := url.QueryUnescape(val)
+			if err != nil {
+				return nil, false
+			}
+			p.Add(":"+name, escval)
 		case path[i] == ph.pat[j]:
 			i++
 			j++

mux_test.go

@@ -244,6 +244,24 @@ func TestMethodPatch(t *testing.T) {
 	}
 }
 
+func TestEscapedUrl(t *testing.T) {
+	p := New()
+
+	var ok bool
+	p.Get("/foo/:name", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ok = true
+		t.Logf("%#v", r.URL.Query())
+		if got, want := r.URL.Query().Get(":name"), "bad/bear"; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+	}))
+
+	p.ServeHTTP(nil, newRequest("GET", "/foo/bad%2fbear?a=b", nil))
+	if !ok {
+		t.Error("handler not called")
+	}
+}
+
 func newRequest(method, urlStr string, body io.Reader) *http.Request {
 	req, err := http.NewRequest(method, urlStr, body)
 	if err != nil {