kitodo-production
kitodo-production copied to clipboard
No URL-encoding of queries over OAI and CUSTOM interfaces
Describe the bug
Queries that are send through CUSTOM and OAI interfaces are not URL-encoded. This results in a java.lang.IllegalArgumentException: Ilegal cahracter
error for queries containing special characters like for example spaces. The user is presented with a stack trace that includes the key used to access the catalog.
To Reproduce Steps to reproduce the behavior:
- Create an CUSTOM or OAI interface, have a working import configuration etc. and a nice project.
- Go to 'Create new process', choose your working import configuration
- Enter an ID that contains a special character (like a blank space), click on 'Search'
- See error, ask everyone watching your screen to forget the credentials displayed in the error message
Expected behavior Special characters should be URL-encoded and not result in an error.
Screenshots
Release 3.6.0
Desktop (please complete the following information):
- OS: any
- Browser: any
- Version: any recent
Additional context This is a problem we are facing with signatures that contain a space character in one part of its name. But generally every signature in our system consists of multiple parts, separated by spaces. So we already had to work around this by introducing a separator character in our database to make any queries possible at all.
We also tried to mitigate this by introducing a „Suchanfragenbegrenzer“ but it doesn't seem to help. The same error is thrown.
According to #4353 there is a problem with url-encoding when using certain interfaces (including OAI). These problems resulted in the restriction to only encode queries to sru interfaces (#4399). As far as I understand, this should only affect the '=' between id parameter and query prefix.
Accordingly, we assume that only this '=' should not be encoded and the rest of the query can safely be url-encoded.
We are preparing a PR to implement these changes.