Is it correct to assume that everything that is not unreserved, can/should be percent-encoded?

RFC 3986说：

“Under normal circumstances, the only time when octets within a URI are percent-encoded is during the process of producing the URI from its component parts. This is when an implementation determines which of the reserved characters are to be used as subcomponent delimiters and which can be safely used as data. “

这意味着您决定根据上下文需要编码哪个分隔符(即< delimiter>)字符.不需要编码的那些不应该被编码.

例如,如果出现在路径组件中,则不应该对/ a进行百分号编码,但是当它出现在查询或片段中时,您应该对它进行百分比编码.

所以,其实一个;字符(它是< reserved>的成员)不应该被自动百分比编码,实际上,java URL和URI类不会这样做;请参阅URI(…) javadoc,具体是第7步),了解< path>组件被处理.

这一点得到加强：

“The purpose of reserved characters is to provide a set of delimiting characters that are distinguishable from other data within a URI. URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent. Percent- encoding a reserved character, or decoding a percent-encoded octet that corresponds to a reserved character, will change how the URI is interpreted by most applications. Thus, characters in the reserved set are protected from normalization and are therefore safe to be used by scheme-specific and producer-specific algorithms for delimiting data subcomponents within a URI.”

所以这说明一个包含百分比编码的URL;与包含raw的URL不同.最后一句话意味着它们不应该被自动编码或解码百分之百.

这让我们有这个问题 – 你为什么要被编码百分比

Let’s say you have a CMS where people can create arbitrary pages having arbitrary paths. Later on, I need to generate href links to all pages in, for example, site map component. Therefore I need an algorithm to know which characters to escape. Semicolon has to be treated literally in this case and should be escaped.

对不起,但不符合分号应该被转义.

就URL / URI规范而言,没有什么特别的意义.它可能对特定的Web服务器/网站有特殊的含义,但一般来说(即没有网站的具体知识),您无法知道这一点.

>如果在一个特定的URI中有特殊的含义,那么如果你的百分之百逃脱它,那么你会破坏这个含义.例如,如果网站使用;以允许将会话令牌附加到路径,然后百分比编码将阻止它识别会话令牌…

>如果只是一些客户端提供的数据字符,那么如果你对它进行了编码,你可能会改变URI的含义.这是否重要取决于服务器的功能？即是否解码,作为应用逻辑的一部分.

这意味着知道“正确的事情”需要深入了解URI对最终用户和/或站点的意义.这将需要高级思维阅读技术来实施.我的建议是通过在将URI路径传递给您的软件之前适当地转义URI路径的任何分隔符来获取CMS来解决它.该算法必然是针对CMS和内容传送平台的.它/他们将响应由URL识别的文档的请求,并且需要知道如何解释它们.

(支持任意使用任意路径的人有点疯狂,必须有一些限制,例如Windows甚至不允许在文件名组件中使用文件分隔符,所以你必须在某处有一些边界.只是一个决定他们应该在哪里的问题.)