spring-hateoas icon indicating copy to clipboard operation
spring-hateoas copied to clipboard

1.5.x no longer % encodes @RequestParam name - produces illegal URI

Open nealeu opened this issue 1 year ago • 1 comments
trafficstars

When (finally) upgrading to 1.5, it appears there is a notable change in the encoding of request parameters where we use linkTo(methodOn(..)).

With 1.3, @RequestParam("with space") appeared as ?with%20space=value which matches the RFC var name spec.

With 1.5, we get ?with space=value which correctly blows up with an illegal URI query character.

There is no documentation or examples that I've found that assert whether Spring HATEOAS supports params with spaces.

For us, this is a regression, but it may be have been an undocumented assumption?

Within the Spring HATEOAS codebase, this change in WebMvcLinkBuilderUnitTest shows the URL containing a space:

@RequestMapping("/foo")
HttpEntity<Void> methodWithRequestParam(@RequestParam("the id") String id) {
	return null;
}

and an update to WebMvcLinkBuilderUnitTest.encodesRequestParameterWithSpecialValue() results in this fail:

Expecting actual:
  "http://localhost/something/foo?the id=Spring%23%0A"
to end with:
  "/something/foo?the%20id=Spring%23%0A"

Note: Tweaking test also fails in the 1.3.x branch, so while it's elsewhere we've got URL encoding differing between 1.3 and 1.5, the above changes demonstrate the incorrect encoding.

nealeu avatar Jan 02 '24 11:01 nealeu

This looks like a side effect of the change made to fix #1722. I'll have to investigate with the core Spring team on how to deal with this.

odrotbohm avatar Jan 11 '24 21:01 odrotbohm