[gdal-dev] WFS driver does not do URL-encoding right

[Even Rouault]

Selon Jukka Rahkonen <jukka.rahkonen at mmmtike.fi>:

> I think this is my last question about WFS and URL-encoding this time.
>
> I had a look how the WFS requests look in hexadecimals.
>
> My TinyOWS and Mapserver WFS both accepts two ways to express letter "ä"
> inside
> ogc:Filter with http GET. First of those alternatives is an UTF-8 letter "ä"
> in
> URL-encoded format which looks as text like %C3%A4. Corresponding hex values
> in
> the GetFeature request seem to be 25-43-33-25-41-34. Another alternative that
> works also it to give letter "ä" in UTF-8 without URL-encoding it and then
> the
> hex values are C3-A4.
>
> My question is that are both alternatives correct to use in http GET?

This is a good question. My guess would be that there might be a old HTTP RFC
that only allowed ASCII characters and thus mandated URL-encoding, and perhaps a
newer RFC that accept all characters. Most servers seem to accept both.

> I have
> thought that URLs should use URL-encoding. OGR WFS driver is itself doing URL
> encoding for <,>," and [space]. Could it be so that expressing "ä" as plain
> C3-A4 in a filter works only because the http GET route is passing them on as
> raw, and WFS server by accident interprets them back to "ä" because it is
> internally using UTF-8?

Yes. But passing the character as 25-43-33-25-41-34 (URL-encoded) or C3-A4
(plain UTF8) requires the WFS driver to interpret it as UTF-8 in both cases. In
XML, UTF-8 is the default encoding, unless otherwise specified. But for other
parameters passed in the GET, this is indeed a good question to know how the
server is supposed which encoding it is...

Note: yesterday after your emails, I've revised substantially how escaping was
done in the WFS driver, because there were cases where URL-escaping would have
been needed (for example if you passed '&' or '%'), so now for 'ä', you should
see 25-43-33-25-41-34 (but that won't solve anything for Windows command line).
There was also missing XML-escaping in some cases (yes, you need to XML-escape
stuff, and then URL-escape it...).