net/url: new JoinPath function and method use Path instead of EscapedPath()

[gazerro]

What version of Go are you using (go version)?

go version go1.19rc1 darwin/amd64

Does this issue reproduce with the latest release?

Yes.

What did you do?

package main

import "net/url"

func main() {
	u, err := url.JoinPath("https://www.example.com/a%2fb", "a%2fb")
	if err != nil {
		panic(err)
	}
	print(u)
}

https://go.dev/play/p/YS_-s65X9n2?v=gotip

What did you expect to see?

https://www.example.com/a%2fb/a%2fb

What did you see instead?

https://www.example.com/a/b/a%2fb

How to fix

In the JoinPath method,

elem = append([]string{u.Path}, elem...)

should be written as

elem = append([]string{u.EscapedPath()}, elem...)

[Stavrospanakakis]

May I try to take this issue? I'd be very happy to open a pull request to resolve it :)

[seankhliao]

net/url.URL.ResolveReference uses EscapedPath(), JoinPath should use it too

[gopherbot]

Change https://go.dev/cl/416774 mentions this issue: net/url: use EscapedPath for url.JoinPath

[ianlancetaylor]

CC @carlmjohnson @neild

[ianlancetaylor]

CC @carlmjohnson @neild

[earthboundkid]

This makes sense to me.

[earthboundkid]

The function calls url.Parse, which turns %2f into /. So I think the output should be /a/b/a/b, no?

[seankhliao]

url.Parse roundtrips /a%2fb when output via .String() and .EscapedPath(), only .Path turns it into /a/b.

[gazerro]

@carlmjohnson See this example

package main

import "net/url"

func main() {
	u, err := url.Parse("https://www.example.com/a%2fb")
	if err != nil {
		panic(err)
	}
	println(u.String())              // print: https://www.example.com/a%2fb
	println(u.JoinPath("").String()) // print: https://www.example.com/a/b
}

JoinPath shouldn't change the URL.