Merge pull request #158 from python-hyper/maybe-a-little-plus-ultra

don't unquote percent-encoded + in to_iri since doing so creates dangerous ambiguity

src/hyperlink/_url.py

@@ -225,7 +225,7 @@ def _make_quote_map(safe_chars):
 _QUERY_KEY_QUOTE_MAP = _make_quote_map(_QUERY_KEY_SAFE)
 _QUERY_KEY_DECODE_MAP = _make_decode_map(_QUERY_KEY_DELIMS)
 _QUERY_VALUE_QUOTE_MAP = _make_quote_map(_QUERY_VALUE_SAFE)
-_QUERY_VALUE_DECODE_MAP = _make_decode_map(_QUERY_VALUE_DELIMS)
+_QUERY_VALUE_DECODE_MAP = _make_decode_map(_QUERY_VALUE_DELIMS | set("+"))
 _FRAGMENT_QUOTE_MAP = _make_quote_map(_FRAGMENT_SAFE)
 _FRAGMENT_DECODE_MAP = _make_decode_map(_FRAGMENT_DELIMS)
 _UNRESERVED_QUOTE_MAP = _make_quote_map(_UNRESERVED_CHARS)

src/hyperlink/test/test_decoded_url.py

@@ -36,6 +36,34 @@ def test_durl_basic(self):
         assert durl.user == "user"
         assert durl.userinfo == ("user", "\0\0\0\0")
 
+    def test_roundtrip_iri_parameter_values(self):
+        # type: () -> None
+        """
+        .to_iri() should never modify the application-level data of a query
+        parameter.
+        """
+        for value in ["hello", "goodbye", "+", "/", ":", "?"]:
+            self.assertEqual(
+                DecodedURL(DecodedURL().set("test", value).to_iri()).get(
+                    "test"
+                ),
+                [value],
+            )
+
+    def test_roundtrip_uri_parameter_values(self):
+        # type: () -> None
+        """
+        .to_uri() should never modify the application-level data of a query
+        parameter.
+        """
+        for value in ["hello", "goodbye", "+", "/", ":", "?"]:
+            self.assertEqual(
+                DecodedURL(DecodedURL().set("test", value).to_uri()).get(
+                    "test"
+                ),
+                [value],
+            )
+
     def test_passthroughs(self):
         # type: () -> None