Escaping (ampersand) in browsable API URLs.

[modernNeo]

I think this issue has come back: #1649

Copy-pasting my comment on that issue here since I am an unsure if anyone got notified about an issue from so far back:

Django==3.2.20
djangorestframework==3.14.0

and I am seeing this load for the next url

<a href="http://127.0.0.1:8000/user_points/?page=2%C3%97tamp%3D5" rel="nofollow"><span class="str">http://127.0.0.1:8000/user_points/?page=2&amp;timestamp=5</span></a>

[browniebroke]

Have you tried with the latest Django and DRF?

[modernNeo]

as I suspected, issue persists with the following modules

Django==5.1.5
djangorestframework==3.15.2

[NikeGunn]

Issue Analysis and Solution: Malformed Pagination URL in DRF 3.14.0

📝 Summary

It appears that issue #1649 has resurfaced in recent DRF versions.

Environment Details
Django version	3.2.20
DRF version	3.14.0

Problem Observed

When pagination is applied, the generated URL is incorrectly encoded:

✅ Expected URL:

http://127.0.0.1:8000/user_points/?page=2&timestamp=5

❌ Actual URL:

http://127.0.0.1:8000/user_points/?page=2%C3%97tamp%3D5

The %C3%97 represents a Unicode multiplication sign (×) instead of an ampersand (&), breaking the query string structure.

🔍 Root Cause

DRF's pagination classes appear to be mishandling query parameter encoding, potentially inserting unexpected characters during the generation of next/previous links.

Proper link construction should leverage urllib.parse or Django's QueryDict to ensure correct URL escaping and encoding.

💡 Recommendation for DRF Maintainers

• Pagination classes should implement proper encoding of query parameters using urlencode
• Manual string manipulation for URL construction should be avoided
• This would prevent Unicode substitution issues and ensure safe URL construction

⚙️ Temporary Workaround

Until this issue is resolved, you can implement a custom pagination class:

from rest_framework.pagination import PageNumberPagination
from urllib.parse import urlencode

class SafePageNumberPagination(PageNumberPagination):
    def get_next_link(self):
        if not self.page.has_next():
            return None
        query_params = self.request.query_params.copy()
        query_params[self.page_query_param] = self.page.next_page_number()
        return f"{self.request.path}?{urlencode(query_params)}"

    def get_previous_link(self):
        if not self.page.has_previous():
            return None
        query_params = self.request.query_params.copy()
        query_params[self.page_query_param] = self.page.previous_page_number()
        return f"{self.request.path}?{urlencode(query_params)}"

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[modernNeo]

can the stale bot be disabled here since this is a valid issue? @peterthomassen

[peterthomassen]

can the stale bot be disabled here since this is a valid issue? @peterthomassen

I have no means to configure bots.

[modernNeo]

@peterthomassen do you know who can?

[browniebroke]

I've looked at the original GH issue and it seems that the fix was made in Django itself (https://code.djangoproject.com/ticket/22267), so the problem may come from there

I can reproduce the behaviour, but only if the existing query parameter on the page in timestamp. I tried with test, stamp, estamp or imestamp and it works perfectly fine. Only "timestamp" seems to be messed up somewhere.

EDIT: actually, it's because of the substring times, which gets escaped as ×

[browniebroke]

Confirmed that we inherit the problem from Django, which probably inherits it from Python:

>>> from django.utils.html import urlize
>>> urlize('"tq": "http://api/foos/1/?p=1&times=1"')
'"tq": "<a href="http://api/foos/1/?p=1%C3%97%3D1">http://api/foos/1/?p=1&times=1</a>"'

Going to close this issue as the bug is not in DRF - tricky one

[peterthomassen]

EDIT: actually, it's because of the substring times, which gets escaped as ×

So that sounds like it would be best to report this to Django folks, using the minimal example in #9643 (comment). @modernNeo