Quoted / character in URL becomes unquoted

[nicolasbock]

Quoted / characters in the TOKEN part of URLs of the form https://domain_name.org/TOKEN/package_name/package-version.tar.gz become unquoted. This is incorrect as the unquoted / is interpreted as a path separator.

This issue came out of the discussion on issue #6437 , in particular from this comment. @cwharland , please feel free to add more details in case I have missed something.

[cwharland]

We ended up solving this on our end by changing the way our private pypi service constructs URLs. We realized that our solution had been accidentally working as the TOKEN was allowed to have / (as AWS provides tokens with that character) so any reasonable URL handler would (and probably should) interpret that as a path separator.

So our use of TOKEN as a path parameter in a REST call was invalid. We fixed it on our end in two steps:

1. We modified our pip wrapper to produce tokens without a / by hex encoding them
2. We modified our pypi service to hex decode the path parameter

This was a work around as we weren't sure if pip supported query params (the better solution) in extra-url.

[cjerdonek]

@nicolasbock Did you want to work on this?

[uranusjr]

I think this can be closed since #7596 fixes the originally reported issue, and #7605 filed as a follow-up.