Support url-encoded characters in URL credentials

pip/download.py

@@ -21,6 +21,7 @@ except ImportError:
 
 from pip._vendor.six.moves.urllib import parse as urllib_parse
 from pip._vendor.six.moves.urllib import request as urllib_request
+from pip._vendor.six.moves.urllib.parse import unquote as urllib_unquote
 
 import pip
 
@@ -130,6 +131,13 @@ def user_agent():
     )
 
 
+def unquote(s):
+    if six.PY2:
+        return urllib_unquote(s.encode("utf-8")).decode("utf-8")
+    else:
+        return urllib_unquote(s)  # utf-8 decode is built in
+
+
 class MultiDomainBasicAuth(AuthBase):
 
     def __init__(self, prompting=True):
@@ -207,8 +215,8 @@ class MultiDomainBasicAuth(AuthBase):
         if "@" in netloc:
             userinfo = netloc.rsplit("@", 1)[0]
             if ":" in userinfo:
-                return userinfo.split(":", 1)
-            return userinfo, None
+                return tuple(unquote(part) for part in userinfo.split(":", 1))
+            return unquote(userinfo), None
         return None, None
 
 

tests/unit/test_download.py

@@ -13,7 +13,7 @@ import pip
 from pip.exceptions import HashMismatch
 from pip.download import (
     PipSession, SafeFileCache, path_to_url, unpack_http_url, url_to_path,
-    unpack_file_url,
+    unpack_file_url, MultiDomainBasicAuth
 )
 from pip.index import Link
 from pip.utils.hashes import Hashes
@@ -333,3 +333,18 @@ class TestPipSession:
         )
 
         assert not hasattr(session.adapters["https://example.com/"], "cache")
+
+
+def test_parse_credentials():
+    auth = MultiDomainBasicAuth()
+    assert auth.parse_credentials(u"foo:bar@example.com") == (u'foo', u'bar')
+    assert auth.parse_credentials(u"foo@example.com") == (u'foo', None)
+    assert auth.parse_credentials(u"example.com") == (None, None)
+
+    # URL-encoded reserved characters:
+    assert auth.parse_credentials(u"user%3Aname:%23%40%5E@example.com") \
+        == (u"user:name", u"#@^")
+
+    # URL-encoded UTF-8:
+    assert auth.parse_credentials(u"%C2%A3:%C2%A3@example.com") \
+        == (u"\u00a3", u"\u00a3")