incorrect usage of urlize?

[modernNeo]

Continuation of #9643

The long of it is that there is this "bug" in how DRF creates a link

>>> from django.utils.html import urlize
>>> urlize('"tq": "http://api/foos/1/?p=1&times=1"')
'"tq": "<a href="http://api/foos/1/?p=1%C3%97%3D1">http://api/foos/1/?p=1&times=1</a>"'

which I was told is actually an issue with Django, however the Django folks response was

Secondly, regarding the urlize example you shared, the behavior occurs specifically when the URL contains × (the HTML entity for ×), rather than any arbitrary ampersand. This happens because urlize is designed to produce HTML-safe links, which may involve encoding characters in the URL to ensure valid HTML. Its purpose is linkification of text for safe display, not exact preservation of the raw URL string.

So I get the sense that maybe DRF is using that function incorrectly?

[browniebroke]

So I get the sense that maybe DRF is using that function incorrectly?

Point me where and send us a fix?

however the Django folks response was

I think the intial report wasn't very clear, by including details which aren't relevenat to Django. When reproting an issue to an open source project, remove anything which is not relevant to that project and report something as simple as possible.

In this instance, that means:

1. Don't mention the "browsable API' as it's not part of Django
2. Boil down the usage to super simple string, remove the partial JSON and show that the problem exists with

   from django.utils.html import urlize
   urlize('http://example.com/foos/?page=2&timestamp=1')

Do the work and see if the issue is really in that project or if it comes from the underlying layer... Try to write a test reproducing the problem/see where it comes from in Django.

From the original ticket, I hinted that the problem might come from Python itself:

Confirmed that we inherit the problem from Django, which probably inherits it from Python:

And indeed:

>>> import html
>>> html.unescape('https://example.com/?page=1&timestamp=3')
'https://example.com/?page=1×tamp=3'

There is however a good reason why this works this way, though...

You might consider changing the query param name if you really want the DRF browsable API to work.