cfml

I posted about this a few days ago and didn't get a response, so I posted on Lucee Forum.

What's the expected behavior of `&lt;cflocation /&gt;` under Lucee with regards to encoding? I'm finding that it _sometimes_ automatically encodes parameters, but not in all situations. Automatic encoding of parameters breaks ACF compatibility, because ACF doesn't do this.

<https://dev.lucee.org/t/cflocation-encoding-of-url/9606>

this one? <https://luceeserver.atlassian.net/browse/LDEV-2759>

<@U070SQMD1> It could be related to that, but it's not the exact same behavior.

any of these? <https://luceeserver.atlassian.net/issues/?jql=labels%20%3D%20%22cflocation%22>

ACF doesn't do any automatic encoding of the URL value, so I'm not sure why Lucee does.

Some of those could be related:

• <https://luceeserver.atlassian.net/browse/LDEV-2461>

• <https://luceeserver.atlassian.net/browse/LDEV-2164>
• <https://luceeserver.atlassian.net/browse/LDEV-2759>

LDEV-2164 talks about having an attribute for encoding, but I'm not sure why Lucee's doing that by default since that is not ACF compatible.

However, it does not seem to encode consistently, so I'm trying to figure out what the expected behavior is.

Like if I build the URL in a separate variable and pass that variable into the URL attribute, it doesn't encode the parameters. Can I assume this is safe to do? Or is this potentially just going to break in a future release because Lucee is expected to always encode the URL attribute?

I don't think it's the job of `&lt;cflocation&gt;` to be encoding anything. Especially given nothing in the documentation says it does.

It should be down to the person providing the string to the `url`attribute. Beyond that, `&lt;cflocation&gt;` should operate on the basis of "garbage in, garbage out". If the person gives it a value that can't be used as a URL for whatever reason, then... error. Don't try to "fix" it by going "oh I know what they probably meant...". Especially if it only does that _sometimes_ as Dan &amp; the Jira ticket seem to be suggesting.

So in looking at the source code, the Location tag is passing the URL to some encoding functions:

<https://github.com/lucee/Lucee/blob/502f15ff31f2c0901cc4ed3934e071b59e65b2ce/core/src/main/java/lucee/runtime/tag/Location.java#L116>

Which ultimately makes it's way to code that runs:

s = <http://java.net|java.net>.URLEncoder.encode(s);
    if (s.indexOf('+') != -1) s = StringUtil.replace(s, "+", "%20", false);
    return s;

That seems like a real bug to me, but I can see how changing the behavior could break a bunch of existing code.

Actually, I tracked the code a little wrong. The logic for the encoding goes to:

<https://github.com/lucee/Lucee/blob/502f15ff31f2c0901cc4ed3934e071b59e65b2ce/core/src/main/java/lucee/commons/net/HTTPUtil.java#L472>