Runtime: WebUtility.UrlDecode works differently compared to HttpUtility.UrlDecode

[hanastasov]

I expected WebUtility.UrlDecode and HttpUtility.UrlDecode to work exactly the same, at least this is what the documentation says.

Seems like HttpUtility.UrlDecode will be able to decode both "%uFF13" and "\uFF13", while WebUtility.Decode will only cope with "\uFF13". I am attaching screenshots below:

HttpUtility.UrlDecode("%uFF13")

HttpUtility.UrlDecode("uFF13")

WebUtility.UrlDecode("%uFF13")

WebUtility.UrlDecode("uFF13")

[davidsh]

@GrabYourPitchforks

[GrabYourPitchforks]

Please don't use %u escaping. I actually tried to remove support for it from .NET 4.5 as a defense-in-depth measure but the change was rejected due to compatibility concerns. It's a legacy format that was never formally approved by any standards body. I don't see us enlightening further components to understand that syntax.

[davidsh]

@hanastasov Thanks for raising this issue. As you can see the current behavior is 'by design' and there are no plans to change it.

[hanastasov]

Please don't use %u escaping. I actually tried to remove support for it from .NET 4.5 as a defense-in-depth measure but the change was rejected due to compatibility concerns. It's a legacy format that was never formally approved by any standards body. I don't see us enlightening further components to understand that syntax.

What is recommended when URL encoding actually uses %u ?

[hanastasov]

Please don't use %u escaping. I actually tried to remove support for it from .NET 4.5 as a defense-in-depth measure but the change was rejected due to compatibility concerns. It's a legacy format that was never formally approved by any standards body. I don't see us enlightening further components to understand that syntax.

What is recommended when URL encoding actually uses %u ?

URL encoding uses % if you use Javascript native escpape. Instead, use encodeURIComponent. Source: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/escape

[GrabYourPitchforks]

What is recommended when URL encoding actually uses %u ?

If you absolutely must support decoding _%u_-escaped payloads then you should keep using HttpUtility.UrlDecode. But try to avoid generating such payloads if you can avoid it. They're non-standard and not well-supported across the broader web ecosystem.

[hanastasov]

What is recommended when URL encoding actually uses %u ?

If you absolutely must support decoding _%u_-escaped payloads then you should keep using HttpUtility.UrlDecode. But try to avoid generating such payloads if you can avoid it. They're non-standard and not well-supported across the broader web ecosystem.

Thanks ! actually I had trouble importing HttpUtility in .NetCore 3.1 project (not sure why), this is why I used WebUtility. But I will be able to migrate to escaping with instead of %.

[davidsh]

Thanks ! actually I had trouble importing HttpUtility in .NetCore 3.1 project (not sure why

The 'HttpUtility' class is in the System.Web namespace. Most of that namespace is not part of .Net Core. That is the original reason why the 'System.Net.WebUtility' class was created. It was meant to replace and be similar to 'HttpUtility'.

[GrabYourPitchforks]

I spoke with @ericstj about this just now. :)

Turns out because HttpUtility is part of netstandard you don't need to add a package for it. You can simply put using System.Web; at the top of your source file and start using the type right away.

using System;
using System.Web;

public class Program {
    public static void Main() {
        Console.WriteLine(HttpUtility.UrlDecode("%u1234"));
    }
}

[hanastasov]

I spoke with @ericstj about this just now. :)

Turns out because HttpUtility is part of netstandard you don't need to add a package for it. You can simply put using System.Web; at the top of your source file and start using the type right away.

using System;
using System.Web;

public class Program {
    public static void Main() {
        Console.WriteLine(HttpUtility.UrlDecode("%u1234"));
    }
}

Not able to do so in .Net Core 3.1, I guess because of the reason that @davidsh explained - part of System.Web is not part of .NetCore. Anyway, I resolved my issue earlier in the pipeline and now I don't encode the URL with %u.