urlparse() should decode percent-encoding in userinfo

[SmartHypercube]

Bug report

Bug description:

RFC 3986 3.2.1 says userinfo = *( unreserved / pct-encoded / sub-delims / ":" ), so userinfo can contain pct-encoded parts and I would expect them to be automatically decoded when parsed. I also tested and confirmed that cURL will decode percent-encoding in userinfo.

This decoding is important because username may be email address which contains @, and password may contain symbols like %, @, etc. If one manipulates URLs using urllib.parse, the current behavior can lead to hard-to-notice bugs.

How to reproduce

import urllib.parse
parse_result = urllib.parse.urlparse('http://a%40b:c%25d@e/')
print(parse_result.username, parse_result.password)

Expected output

a@b c%d

Actual output

a%40b c%25d

CPython versions tested on:

3.9, 3.12

Operating systems tested on:

Linux

[pygeek]

What you are looking for is urllib.parse.unquote. urllib.parse.urlparse does not unquote, it only parses the url into six components.

>>> urllib.parse.unquote("http://a%40b:c%25d@e/")
'http://a@b:c%d@e/'

[SmartHypercube]

I see. That makes sense. Thanks for your reply!

(I was thinking "since it already parsed the URL, why not unquote it?" But the path and query components actually cannot be unquoted at this stage. Only individual parts of the path and individual keys and values of the query can be safely unquoted. Similarly, userinfo as a whole cannot be safely unquoted. Only username and password can be safely unquoted. So "only parse, not unquote" for all components is a very reasonable design for urlparse.)