Bug 36986

Mod_rewrite has problems with the special character codes %23, %26, and %2F (for
‘#’, ‘&’, ‘/’) appearing in the request URL - the URL pattern being rewritten.

‘%23’ and ‘%26’ seem to escape the rewrite (any substitution variables after
this point seem to be set to null). ‘%2F’ causes the rewrite to break (404
error) in all examples I tested.

mod_rewrite seems to automatically decode the '%25' code. So these characters
can be passed on by replacing the '%' with '%25', and passing the characters
into the URL as ‘%2523’, ‘%2526’, and ‘%252F’.

However, this workaround causes the variable values to be treated differently
than if they were passed from the un-rewritten URL. E.g., given the RewriteRule:

RewriteRule ^test/(.*) test.php?testvar=$1

In the case of the pattern URL:
	/test/apples%2526oranges
Versus a direct request to:
	/test.php?testvar=apples%2526oranges
The variable testvar would have a value of ‘&’ in the former, and ‘%26’ in the
latter. This inconsistency can be solved by regex substitutions in GET variables
in the script itself, but that doesn’t seem like a transparent or robust solution.

Note that the [NE] flag is for the substitution side rather than the pattern
side, so that doesn't help here.

To me this seems to be a bug, as %23, %26 and %2F probably shouldn't be treated
any differently than other special character codes.


Also, I couldn't find the tendency of mod_rewrite to automatically decode '%25'
before rewriting (when it is followed by a two-character hexadecimal code) noted
anywhere in the documentation, and I think it should be. And this, too, can
cause problems. e.g., given the same RewriteRule above, requests to:

/test/sports%25fan
	versus:
/test.php?testvar=sports%25fan

Result in different values of testvar: 'sportsún' versus 'sports%fan'.

I am unsure if this should be classified as a separate issue, but since both
issues are strongly related I am reporting them together.

Regards,
Saqib