aws-lambda-fastify icon indicating copy to clipboard operation
aws-lambda-fastify copied to clipboard

Incorrect splitting of query parameters parameters containing literal commas

Open jmalins opened this issue 1 year ago • 3 comments

The current query string translation logic doesn't distinguish between repeated query string values (i.e. &key=a&key=b) and values that contain URL encoded literal commas (i.e. &key=a%2Cb). The former should map to a fastify array value, the latter should not. It appears the API GW V2.0 event format has this same hazard.

The two cases could be distinguished by parsing the rawQueryString value (or for performance reasons, doing this only when a potential split is detected).

https://github.com/fastify/aws-lambda-fastify/blob/2e9387bfc8172be360c1bac997db216f7535d7fa/index.js#L65

jmalins avatar Feb 22 '24 14:02 jmalins

Feel free to propose a PR.

adrai avatar Feb 22 '24 15:02 adrai

Thanks, will do. I have a workaround for now, but expect one in the next few days.

jmalins avatar Feb 22 '24 16:02 jmalins

Hi @jmalins can you please share your workaround ? I'm facing the same issue with commas

mouhannad-sh avatar May 13 '24 07:05 mouhannad-sh

I'm not sure if this is an intended behavior but I realised that the query string translation is mutating the original event argument passed to the lambda. For example if you pass &key=a%2Cb : When logging request.awsLambda.event you will get

{key: ["a","b"]}

even though the original event passed from API gateway is:

{"key": "a,b"}

This was confusing in our case because it made my team doubt that API gateway itself was transforming the query

I submitted a PR to address this behavior ( within the scope of the querystring ). and added a new option to allow users to opt-out from the current behaviour without causing any breaking changes for existing users

mouhannad-sh avatar May 13 '24 10:05 mouhannad-sh

related to https://github.com/fastify/aws-lambda-fastify/issues/125 @maxkre96

adrai avatar May 13 '24 10:05 adrai