search

ring-clojure / ring-codec

Utility library for encoding and decoding data
MIT License
63 stars 30 forks source link

Do not try to decode percent sign followed by invalid hex digits. #2

Closed f355 closed 11 years ago

f355 commented 11 years ago

I think that when validating external input it is more important to get at least some result rather than non-informative NumberFormatException.

weavejester commented 11 years ago

I'm not sure I agree. Trying to parse invalid data is going to result in unpredictable behaviour. It's better to error out early so that the client is informed of its mistake.

I also suspect that most HTTP requests come either from browsers or HTTP client libraries, both of which should ensure that the URL is valid before initiating the request

f355 commented 11 years ago

I'm using this library to handle historical access logs, which can contain any kind of weird URLs and (especially) referrers, and I need to extract as much useful information as possible.

I don't think that not decoding percent and two arbitrary characters can result in any kind of unpredictable behavior due to the fact that the same sequence of characters might be a result of decoding some valid input.

But of course that is just my opinion, and decision is up to you.

weavejester commented 11 years ago

I think your use-case is fairly specialised, in that you're attempting to tease useful information out from syntactically incorrect data. Against an active connection, which is where ring-codec is most often used, it's better to throw an error early than to allow bad data through. I think in this case I'll lean toward the more common use case.

However, you're more than welcome to pull out the code in question and adapt it for use in your project.

f355 commented 11 years ago

Sure, thank you anyways.