Nano does not escape partition ID's

[swansontec]

Expected Behavior

When a partition ID includes special characters, such as '/' or '+', Nano should escape those using encodeURIComponent, just as it does already for document ID's, design document names, database names, and so forth.

Current Behavior

Nano just concatenates the partition ID into the URI without escaping, which is dangerous:

couchdb-nano/lib/nano.js

Line 1050 in 2d4bd71

path: '_partition/' + partitionKey + '/_all_docs',

Possible Solution

Incorporate encodeURIComponent into the following methods:

• partitionInfo
• partitionedList
• partitionedFind
• partitionedSearch
• partitionedView
• partitionedListAsStream
• partitionedFindAsStream
• partitionedSearchAsStream
• partitionedViewAsStream

Steps to Reproduce (for bugs)

Any partitioned call involving special characters, such as a base64-encoded string, will randomly fail if the encoding produces special characters:

myDb.partitionedList(base64.encode(...))

Context

We are temporarily working around this by doing the encodeURIcomponent in our app, before passing the partition ID to Nano. This allows our queries to succeed for now, since we convert characters like '+' to '%2b' before passing to Nano.

This implies that fixing this bug would be a breaking change, since presumably other people have run into the same issue and have adopted the same workaround. If the client app calls encodeURIcomponent, and then Nano itself calls encodeURIcomponent again, a character like '+' would become '%2b' in the client code, and then '%252b' in Nano, which is wrong.

So, while Nano should address this eventually, it may be necessary to wait for a v10 breaking release.

Your Environment

• Version used: 9.0.4