net/url: url.Parse("example.com/oid/[order_id]") escapes [ ] in String() method

[mpbuettner]

RFC 3986 specifies that reserved characters in URL paths should not be escaped, and
shouldEscape() is designed to enforce that.

The RFC specifies the following set as reserved:
gen-delims:  ":", "/", "?", "#", "[",
"]", "@"
sub-delims: "!", "$", "&", "'",
"(", ")", "*", "+", ",",
";", "="

shouldEscape() only checks the following subset, and escapes the rest:
'$', '&', '+', ',', '/', ':', ';', '=', '?', '@'

When proxying, "http://example.com/oid/[order_id]", the "[" and
"]" get escaped, which is a bug. Servers may well handle
".../oid/[order_id]" and ".../oid/%5Border_id%5D" differently. 

Example below:
http://play.golang.org/p/Vczuon9WR-

[robpike]

Comment 1:

Labels changed: added priority-soon, packagechange, removed priority-triage.

Owner changed to @bradfitz.

Status changed to Accepted.

[rsc]

Comment 2:

I am sure this will break something. If you prepare a CL, look at the code history.

Labels changed: added go1.2maybe.

[rsc]

Comment 3:

Labels changed: added feature.

[bradfitz]

Comment 4:

Labels changed: added suggested.

[robpike]

Comment 5:

Not in time for 1.2.

Labels changed: removed go1.2maybe.

[rsc]

Comment 6:

Labels changed: added go1.3maybe.

[rsc]

Comment 7:

Labels changed: removed feature.

[rsc]

Comment 8:

Labels changed: added release-none, removed go1.3maybe.

[rsc]

Comment 9:

Labels changed: added repo-main.

[bradfitz]

Comment 10:

Issue #6784 has been merged into this issue.

[andybalholm]

Comment 11:

Russ Cox pointed out that a workaround is documented at http://godoc.org/net/url#URL, in
the paragraph starting with "Note that the path field…"
That worked for me, once I realized that if the request is going through a proxy, the
host should be included in the Opaque field, but if it isn't, the Opaque field should be
just the path.

[bradfitz]

Comment 12:

Issue #7914 has been merged into this issue.

[bradfitz]

Comment 13:

Any code change (trivial) would have to be accompanied by convincing research that this
won't break anything (non-trivial).

Labels changed: removed priority-soon.

Owner changed to ---.

[gopherbot]

Comment 14 by aaron.blohowiak:

What kind of shape would convincing research take? Here are my thoughts.
1. Evaluate how other proxies (mod_proxy, nginx proxy_pass, haproxy) handle the
sub-delims in each of path, userinfo and password.
2. Evaluate how url.RequestURI is being used in the stdlib, identifying any places that
might be impacted negatively by this change and a plan to test / evaluate the impact.
I will also review the history of the CL as per rsc in #2

[bradfitz]

Comment 15:

Issue #7975 has been merged into this issue.