From 3ee89515a0ef4852f64b13133c22aa7d3a322cfd Mon Sep 17 00:00:00 2001
From: Herbert Leuwer <herbert.leuwer@t-online.de>
Date: Sun, 19 Nov 2017 19:48:37 +0100
Subject: [PATCH 1/2] fixed URL parsing in url.lua: parse fragment after
 parsing username and password.

---
 src/url.lua | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/url.lua b/src/url.lua
index d61111e..6448853 100644
--- a/src/url.lua
+++ b/src/url.lua
@@ -131,11 +131,6 @@ function _M.parse(url, default)
     if not url or url == "" then return nil, "invalid url" end
     -- remove whitespace
     -- url = string.gsub(url, "%s", "")
-    -- get fragment
-    url = string.gsub(url, "#(.*)$", function(f)
-        parsed.fragment = f
-        return ""
-    end)
     -- get scheme
     url = string.gsub(url, "^([%w][%w%+%-%.]*)%:",
         function(s) parsed.scheme = s; return "" end)
@@ -149,6 +144,11 @@ function _M.parse(url, default)
         parsed.query = q
         return ""
     end)
+    -- get fragment
+    url = string.gsub(url, "#(.*)$", function(f)
+        parsed.fragment = f
+        return ""
+    end)
     -- get params
     url = string.gsub(url, "%;(.*)", function(p)
         parsed.params = p

From 2d6a0f7bda9241f827a3edbfa738603c024a423b Mon Sep 17 00:00:00 2001
From: Herbert Leuwer <herbert.leuwer@t-online.de>
Date: Wed, 22 Nov 2017 09:30:12 +0100
Subject: [PATCH 2/2] fixed url parsing; postpone fragment parsing after
 authority parsing; added test cases to test/urltest.lua fixed reference
 patterns in check_protect() to upper case hex letters

---
 src/url.lua      | 10 +++----
 test/urltest.lua | 75 ++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 77 insertions(+), 8 deletions(-)

diff --git a/src/url.lua b/src/url.lua
index 6448853..110ea94 100644
--- a/src/url.lua
+++ b/src/url.lua
@@ -139,16 +139,16 @@ function _M.parse(url, default)
         parsed.authority = n
         return ""
     end)
-    -- get query string
-    url = string.gsub(url, "%?(.*)", function(q)
-        parsed.query = q
-        return ""
-    end)
     -- get fragment
     url = string.gsub(url, "#(.*)$", function(f)
         parsed.fragment = f
         return ""
     end)
+    -- get query string
+    url = string.gsub(url, "%?(.*)", function(q)
+        parsed.query = q
+        return ""
+    end)
     -- get params
     url = string.gsub(url, "%;(.*)", function(p)
         parsed.params = p
diff --git a/test/urltest.lua b/test/urltest.lua
index 32cb348..1090a7e 100644
--- a/test/urltest.lua
+++ b/test/urltest.lua
@@ -90,6 +90,75 @@ local check_parse_url = function(gaba)
 end
 
 print("testing URL parsing")
+check_parse_url{
+    url = "scheme://user:pass$%?#wd@host:port/path;params?query#fragment",
+    scheme = "scheme", 
+    authority = "user:pass$%?#wd@host:port", 
+    host = "host",
+    port = "port",
+    userinfo = "user:pass$%?#wd",
+    password = "pass$%?#wd",
+    user = "user",
+    path = "/path",
+    params = "params",
+    query = "query",
+    fragment = "fragment"
+}
+check_parse_url{
+    url = "scheme://user:pass?#wd@host:port/path;params?query#fragment",
+    scheme = "scheme", 
+    authority = "user:pass?#wd@host:port", 
+    host = "host",
+    port = "port",
+    userinfo = "user:pass?#wd",
+    password = "pass?#wd",
+    user = "user",
+    path = "/path",
+    params = "params",
+    query = "query",
+    fragment = "fragment"
+}
+check_parse_url{
+    url = "scheme://user:pass-wd@host:port/path;params?query#fragment",
+    scheme = "scheme", 
+    authority = "user:pass-wd@host:port", 
+    host = "host",
+    port = "port",
+    userinfo = "user:pass-wd",
+    password = "pass-wd",
+    user = "user",
+    path = "/path",
+    params = "params",
+    query = "query",
+    fragment = "fragment"
+}
+check_parse_url{
+    url = "scheme://user:pass#wd@host:port/path;params?query#fragment",
+    scheme = "scheme", 
+    authority = "user:pass#wd@host:port", 
+    host = "host",
+    port = "port",
+    userinfo = "user:pass#wd",
+    password = "pass#wd",
+    user = "user",
+    path = "/path",
+    params = "params",
+    query = "query",
+    fragment = "fragment"
+}
+check_parse_url{
+    url = "scheme://user:pass#wd@host:port/path;params?query",
+    scheme = "scheme", 
+    authority = "user:pass#wd@host:port", 
+    host = "host",
+    port = "port",
+    userinfo = "user:pass#wd",
+    password = "pass#wd",
+    user = "user",
+    path = "/path",
+    params = "params",
+    query = "query",
+}
 check_parse_url{
     url = "scheme://userinfo@host:port/path;params?query#fragment",
     scheme = "scheme", 
@@ -608,9 +677,9 @@ check_parse_path("eu/tu", { "eu", "tu" })
 print("testing path protection")
 check_protect({ "eu", "-_.!~*'():@&=+$,", "tu" }, "eu/-_.!~*'():@&=+$,/tu")
 check_protect({ "eu ", "~diego" }, "eu%20/~diego")
-check_protect({ "/eu>", "<diego?" }, "%2feu%3e/%3cdiego%3f")
-check_protect({ "\\eu]", "[diego`" }, "%5ceu%5d/%5bdiego%60")
-check_protect({ "{eu}", "|diego\127" }, "%7beu%7d/%7cdiego%7f")
+check_protect({ "/eu>", "<diego?" }, "%2Feu%3E/%3Cdiego%3F")
+check_protect({ "\\eu]", "[diego`" }, "%5Ceu%5D/%5Bdiego%60")
+check_protect({ "{eu}", "|diego\127" }, "%7Beu%7D/%7Cdiego%7F")
 check_protect({ "eu ", "~diego" }, "eu /~diego", 1)
 check_protect({ "/eu>", "<diego?" }, "/eu>/<diego?", 1)
 check_protect({ "\\eu]", "[diego`" }, "\\eu]/[diego`", 1)