strange behaviour with ampersand in REST API /messages

[fblackburn1]

MongooseIM version: 2.0.1 Installed from: source Erlang/OTP version: 17 from debian Jessie

Given MongooseIM with mod_http_notification enabled When I make the following request: curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' -d '{"to": "alice@localhost", "caller": "bob@localhost", "body": "Hi Rabbit!&escape=Hello" }' 'http://localhost:8088/api/messages' Then MongooseIM make a callback with the following data: ('escape', 'Hello'), ('message', 'Hi Rabbit!'), ('receiver', 'alice'), ('author', 'bob'), ('server', 'localhost') Expected: ('message', 'Hi Rabbit!&escape=Hello'), ('receiver', 'alice'), ('author', 'bob'), ('server', 'localhost')

Workaround: escape de ampersand (&) with %26 before sending resquest

I don't know if we can reproduce this bug with the /messages from 8089, because when I use the user's api, the callback is not triggered :/. In such case, this can be a security issue. (e.i. duplicate the keys message/receiver/author/server)

[fenek]

Hi @fblackburn1

Thanks for spotting this. Someone from the team will investigate it.