From 9a8c38e365e9c596e4c3b648ed675716b57eff7d Mon Sep 17 00:00:00 2001
From: mattp <1196252+mattpr@users.noreply.github.com>
Date: Mon, 14 Mar 2022 16:48:40 +0100
Subject: [PATCH] Do not url decode when baseURL is set.

---
 data.go      | 15 +++++++++------
 data_test.go |  8 ++++----
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/data.go b/data.go
index 0692cc6..6be3c15 100644
--- a/data.go
+++ b/data.go
@@ -331,7 +331,7 @@ func NewRequest(r *http.Request, baseURL *url.URL) (*Request, error) {
 		return nil, URLError{"too few path segments", r.URL}
 	}
 
-	req.URL, err = parseURL(parts[1])
+	req.URL, err = parseURL(parts[1], (baseURL == nil))
 	if err != nil {
 		return nil, URLError{fmt.Sprintf("unable to parse remote URL: %v", err), r.URL}
 	}
@@ -343,7 +343,7 @@ func NewRequest(r *http.Request, baseURL *url.URL) (*Request, error) {
 	}
 
 	if !req.URL.IsAbs() {
-		return nil, URLError{"must provide absolute remote URL", r.URL}
+		return nil, URLError{"must provide absolute remote URL", req.URL}
 	}
 
 	if req.URL.Scheme != "http" && req.URL.Scheme != "https" {
@@ -367,15 +367,18 @@ var reCleanedURL = regexp.MustCompile(`^(https?):/+([^/])`)
 
 // parseURL parses s as a URL, handling URLs that have been munged by
 // path.Clean or a webserver that collapses multiple slashes.
-func parseURL(s string) (*url.URL, error) {
+func parseURL(s string, urlDecode bool) (*url.URL, error) {
 	var err error
 
 	// convert http:/example.com to http://example.com
 	s = reCleanedURL.ReplaceAllString(s, "$1://$2")
 
-	s, err = decodeURL(s)
-	if err != nil {
-		return nil, err
+	// only decode remote url param if baseURL is not set
+	if urlDecode {
+		s, err = decodeURL(s)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return url.Parse(s)
diff --git a/data_test.go b/data_test.go
index b6a0de2..42fe864 100644
--- a/data_test.go
+++ b/data_test.go
@@ -247,12 +247,12 @@ func TestNewRequest_BaseURL(t *testing.T) {
 			"http://localhost/x/../foo/bar",
 			"http://example.com/foo/bar", emptyOptions, false,
 		},
-		// relative remote urls should not have URL Decoding even if
-		// they start with http... (dirname)
+		// relative remote urls (baseURL set) should not have URL Decoding even if
+		// they start with http
 		{
 			"http://example.com/hello/",
-			"http://localhost/x/httpdir/rela%20tive",
-			"http://example.com/hello/httpdir/rela%20tive", emptyOptions, false,
+			"http://localhost/x/https%3A%2F%2Fimg.example.com%2Fpic.jpg",
+			"http://example.com/hello/https%3A%2F%2Fimg.example.com%2Fpic.jpg", emptyOptions, false,
 		},
 	}