fix(auth): decode percent-encoded credentials from URL

httpie/cli/argparser.py

@@ -5,7 +5,7 @@
 import sys
 from argparse import RawDescriptionHelpFormatter
 from textwrap import dedent
-from urllib.parse import urlsplit
+from urllib.parse import urlsplit, unquote
 
 from requests.utils import get_netrc_auth
 
@@ -288,9 +288,10 @@ def _process_auth(self):
 
         if self.args.auth is None and not auth_type_set:
             if url.username is not None:
-                # Handle http://username:password@hostname/
-                username = url.username
-                password = url.password or ''
+                raw_userinfo = url.netloc.rsplit('@', 1)[0]
+                raw_username, sep, raw_password = raw_userinfo.partition(':')
+                username = unquote(raw_username)
+                password = unquote(raw_password) if sep else ''
                 self.args.auth = AuthCredentials(
                     key=username,
                     value=password,

tests/test_auth.py

@@ -55,6 +55,16 @@ def test_credentials_in_url(httpbin_both):
     assert r.json == {'authenticated': True, 'user': 'user'}
 
 
+def test_percent_encoded_credentials_in_url(httpbin_both):
+    url = add_auth(
+        httpbin_both.url + '/basic-auth/u%40d/1%3d2%3f',
+        auth='u%40d:1%3d2%3f',
+    )
+    r = http('GET', url)
+    assert HTTP_OK in r
+    assert r.json == {'authenticated': True, 'user': 'u@d'}
+
+
 def test_credentials_in_url_auth_flag_has_priority(httpbin_both):
     """When credentials are passed in URL and via -a at the same time,
      then the ones from -a are used."""