[insaf021]

Fixes #4728

redis://us%3Aer:pw@host  ->  getUser="us", getPassword="er:pw"
                             (want user "us:er", password "pw")

getUser/getPassword read uri.getUserInfo(), which percent-decodes the userinfo before the user:password split. A %3A in the username decodes to a literal : first, so split(":", 2) lands on it and the credentials are cut at the wrong point, sending the wrong ACL identity to AUTH.

Splitting uri.getRawUserInfo() keeps the encoded colon as %3A, so only the real separator is a literal :, and each half is decoded after the split. + is kept literal since userinfo is not form data, so passwords already containing + are unaffected.

---

Note

Medium Risk
Changes how URI credentials are parsed for Jedis client setup and AUTH; behavior shifts only for percent-encoded userinfo edge cases, but incorrect parsing previously sent wrong ACL identities.

Overview
Fixes incorrect user/password extraction when Redis connection URIs contain percent-encoded characters in the userinfo segment (e.g. %3A in a username).

getUser and getPassword now split on getRawUserInfo() instead of getUserInfo(), so encoded colons do not become literal : before the split and move the boundary. Each side is UTF-8 percent-decoded after the split via a new decode helper; + is treated as literal (not form-style space) by escaping it before URLDecoder.

Tests cover encoded colons in usernames and encoded specials / plus signs in passwords.

^{Reviewed by Cursor Bugbot for commit 0b20113. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ggivo]

Thanks for the fix — we'll take a closer look shortly.

[insaf021]

Filed #4728 with the repro so this has a tracked issue. Also merged master in: the red SDR job was the xinfo expected 2 / got 1 failure that hit every PR between 4 and 7 August and has since been fixed in the workflow, nothing in this diff goes near streams.

[atakavci]

LGTM!

[atakavci]

javadoc remains to reference to getUserInfo

[ggivo]

LGTM