Visual RFC.
ALL RFCs / RFC 2392
Read the RFC ↗
RFC 2392 / MESSAGE AND BODY-PART REFERENCES

Convert URL escapes and header brackets

02

A URL and a message header represent the same identifier using different notation. Percent escapes encode identifier characters; they do not encode the image or attachment payload.

RFC 2392 · § 2EXAMPLE
5 / 5
Convert URL escapes and header bracketsA URL and a message header represent the same identifier using different notation. Percent escapes encode identifier characters; they do not encode the image or attachment payload. Selected invalid input cid:p%2Gq@picnic.example has a non-hex escape. The decoder rejects the malformed escape before constructing a header value. RFC 2392 does not define a mail-client error code or recovery policy.Two notations for the same identifiercid:p%2Gq@picnic.exampleInvalid hex escape: stopNo header value constructedInvalid escape prevents header conversionThe application chooses how to report or recoverRFC 2392 · fictional identifiers · schematic
05
Stop a malformed escape before header output

Selected invalid input cid:p%2Gq@picnic.example has a non-hex escape. The decoder rejects the malformed escape before constructing a header value. RFC 2392 does not define a mail-client error code or recovery policy.

Source for this drawing: RFC 2392 · Read RFC section 2 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

What changed
RFC 2392 published exampleVerified erratum 454

The published URL containing %25 corresponds to a header identifier with one literal percent sign. The erratum corrects the example; the decoding rule itself remains unchanged.

Read the updated RFC section ↗
KEY POINT

To make a cid URL, take the identifier out of its header’s angle brackets and escape characters that need URL encoding, including a slash within an identifier.

  • To make a cid URL, take the identifier out of its header’s angle brackets and escape characters that need URL encoding, including a slash within an identifier.
  • To recover the header value, remove cid:, decode percent escapes to their US-ASCII characters once, then surround the identifier with angle brackets.
  • Verified erratum 454 corrects the published example: %25 becomes one literal percent sign in the header. A sequence produced by that decoding is not automatically decoded a second time.
  • The bounded examples use unquoted ASCII identifiers. Plus remains a plus; this is not HTML-form decoding. Quoted mail syntax, internationalized identifiers and full header validation are outside the helper’s scope.
DETAILS

Fictional .example identifiers; payloads are omitted. Consult the linked MIME and message-format specifications for complete parsing, retrieval and security requirements.

Read the RFC section ↗

All chapters in RFC 2392

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗