Escape all path pieces and query parameters

changelog.md

@@ -1,3 +1,18 @@
+0.3.3
+-----
+
+Explicitly escape reserved characters from path pieces and query parameters
+
+
+0.3.2
+-----
+
+- **Addition of 'Servant.Reflex.Common.Req.ClientOpts'** which
+allows the users to apply a final adjustment to Requests before
+thery are sent, such as setting the 'withCredentials' flag
+or print the Request to the console for debugging
+[PR #47](https://github.com/imalsogreg/servant-reflex/pull/47)
+
 0.3
 ---
 

servant-reflex.cabal

@@ -1,5 +1,5 @@
 Name: servant-reflex
-Version: 0.3.2
+Version: 0.3.3
 Synopsis: Servant reflex API generator
 Description: Servant reflex API generator
 License: BSD3

src/Servant/Common/Req.hs

@@ -28,6 +28,7 @@ import qualified Data.Text                  as T
 import qualified Data.Text.Encoding         as TE
 import           Data.Traversable           (forM)
 import           Language.Javascript.JSaddle.Monad (JSM, MonadJSM)
+import qualified Network.URI                as N
 import           Reflex.Dom                 hiding (tag)
 import           Servant.Common.BaseUrl     (BaseUrl, showBaseUrl,
                                              SupportsServantReflex)
@@ -170,7 +171,7 @@ reqToReflexRequest reqMeth reqHost req =
 
       urlPath :: Dynamic t (Either Text Text)
       urlPath = (fmap.fmap)
-                (T.intercalate "/" . fmap (builderToText . toEncodedUrlPiece))
+                (T.intercalate "/" . fmap escape)
                 urlParts
 
       queryPartString :: (Text, QueryPart t) -> Dynamic t (Maybe (Either Text Text))
@@ -182,7 +183,9 @@ reqToReflexRequest reqMeth reqHost req =
         QueryPartParams ps -> ffor ps $ \pStrings ->
           if null pStrings
           then Nothing
-          else Just $ Right (T.intercalate "&" (fmap (\p -> pName <> "=" <> p) pStrings))
+          else Just . Right
+               . T.intercalate "&"
+               $ fmap (\p -> pName <> "=" <> escape p) pStrings
         QueryPartFlag fl -> ffor fl $ \case
           True ->  Just $ Right pName
           False -> Nothing
@@ -400,3 +403,6 @@ fmapL f (Left e)  = Left (f e)
 
 builderToText :: Builder.Builder -> T.Text
 builderToText = TE.decodeUtf8 . BL.toStrict . Builder.toLazyByteString
+
+escape :: T.Text -> T.Text
+escape = T.pack . N.escapeURIString (not . N.isReserved) . T.unpack . TE.decodeUtf8 . BL.toStrict . Builder.toLazyByteString . toEncodedUrlPiece