% in error message being encoded into %% (by Tornado HTTPError)

[ptch314]

Description

We have a use case where the server is expected in some cases to return a “400 Bad Request” response with a message that includes a URL-encoded string. However, the URL-encoded text unexpectedly comes back with all %s being transformed into %%s. We want to know if this is a bug in Jupyter, a bug in a Jupyter dependency (Tornado), or expected behavior that we need to work around.

Reproduce

The issue is difficult to reproduce without running a server that returns an error message with % characters in the HTTP response.

To elaborate, the %s come from us wanting to return an error message with a nested, URL-encoded URL that already has encoded symbols, such as https://example.com/?redirect=http%3A%2F%2F. But because of the issue, they are being returned as https://example.com/?redirect=http%%3A%%2F%%2F instead.

Context

• Operating System and version: N/A
• Browser and version: N/A
• Jupyter Server version: v2.15.0

We looked into the Jupyter Server source code, and identified the root cause is likely

jupyter_server/jupyter_server/gateway/gateway_client.py

Lines 789 to 793 in c67a46b

	raise web.HTTPError(
	e.code,
	f"Error from Gateway: [{error_message}] {error_reason}. "
	"Ensure gateway url is valid and the Gateway instance is running.",
	) from e

, where it is calling the HTTPError constructor with an f-string log_message argument to inject placeholder values instead of using the syntax expected by Tornado of %s in log_message and placeholder values in the args. This is compounded by Tornado encoding all %s in the log_message (but not in the args) into %%s.

https://www.tornadoweb.org/en/stable/_modules/tornado/web.html#HTTPError

        if log_message and not args:
            self.log_message = log_message.replace("%", "%%")