Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: prevent duplicated encoding request parameters filter #3598

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

raccoonback
Copy link

@raccoonback raccoonback commented Nov 18, 2024

Hello.

I found that there is a case where the encoded query parameter in the RewriteRequestParameterGatewayFilterFactory and RemoveRequestHeaderGatewayFilterFactory factory filters encodes the % character again.

For example, if we apply the RemoveRequestHeaderGatewayFilterFactory filter to http://localhost?foo%5B%5D=123&bar=456 to remove the bar parameter, % becomes an encoding target, and the query parameter is duplicated and encoded as http://localhost?foo%255B%255D=123.
I think I should keep the existing encoded query parameter as http://localhost?foo%5B%5D=123.

Therefore, I will explain the items processed for each filter in more detail.

RewriteRequestParameterGatewayFilterFactory

Reason

  1. Previously, it checked whether config.getName() existed in ServerWebExchange.getRequest().getQueryParams() and directly replaced config.getReplacement() in UriComponentsBuilder.
    If the query parameter to be replaced is encoded, there is a problem that the name and replacement of config may not be replaced properly.
    Even if we inject it by encoding it in config, it may be encoded twice as a result and it may not be found in ServerWebExchange.getRequest().getQueryParams().
  2. Encode not only query parameters but also other segments.
    (since UriComponentsBuilder.build() encodes them by default)
    For example, if it is http://localhost?foo=123#bar=baz%5B%5D, it can be encoded once more up to the fragment, like http://localhost?foo=123#bar=baz%255B%255D.

Solve

  1. Modify to replace query parameters based on the return value of ServerWebExchange.getRequest().getQueryParams().
    (ServerWebExchange.getRequest().getQueryParams() internally returns decoded query parameters).

  2. Encode only the query parameters and inject them into the UriComponentsBuilder, and do not attempt to encode other segments.

RemoveRequestHeaderGatewayFilterFactory

  1. The second reason for RewriteRequestParameterGatewayFilterFactory is the same.
    Modify it to encode only the query parameters segment.

Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants