Fix: prevent duplicated encoding request parameters filter #3598
+88
−19
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello.
I found that there is a case where the encoded query parameter in the
RewriteRequestParameterGatewayFilterFactory
andRemoveRequestHeaderGatewayFilterFactory
factory filters encodes the%
character again.For example, if we apply the
RemoveRequestHeaderGatewayFilterFactory
filter tohttp://localhost?foo%5B%5D=123&bar=456
to remove the bar parameter,%
becomes an encoding target, and the query parameter is duplicated and encoded ashttp://localhost?foo%255B%255D=123
.I think I should keep the existing encoded query parameter as
http://localhost?foo%5B%5D=123
.Therefore, I will explain the items processed for each filter in more detail.
RewriteRequestParameterGatewayFilterFactory
Reason
config.getName()
existed inServerWebExchange.getRequest().getQueryParams()
and directly replacedconfig.getReplacement()
inUriComponentsBuilder
.If the query parameter to be replaced is encoded, there is a problem that the
name
andreplacement
ofconfig
may not be replaced properly.Even if we inject it by encoding it in config, it may be encoded twice as a result and it may not be found in
ServerWebExchange.getRequest().getQueryParams()
.(since
UriComponentsBuilder.build()
encodes them by default)For example, if it is
http://localhost?foo=123#bar=baz%5B%5D
, it can be encoded once more up to the fragment, likehttp://localhost?foo=123#bar=baz%255B%255D
.Solve
Modify to replace query parameters based on the return value of
ServerWebExchange.getRequest().getQueryParams()
.(
ServerWebExchange.getRequest().getQueryParams()
internally returns decoded query parameters).Encode only the query parameters and inject them into the
UriComponentsBuilder
, and do not attempt to encode other segments.RemoveRequestHeaderGatewayFilterFactory
RewriteRequestParameterGatewayFilterFactory
is the same.Modify it to encode only the query parameters segment.
Thanks.