Fix RequestValidator URL encoding preservation during port manipulation
The RequestValidator.validate method was incorrectly decoding URL-encoded characters when manipulating ports, causing validation failures for URLs with encoded query parameters, paths, or user info.
Problem
When validating URLs with ports, the updatePort method was using decoded URI components (getPath(), getQuery(), getFragment(), getUserInfo()), which automatically decoded URL-encoded characters. This caused URLs like:
https://someurl.com:443/somepath?param1=client%3AAnonymous
to be incorrectly converted to:
https://someurl.com/somepath?param1=client:Anonymous
This resulted in different signature validation for equivalent URLs with and without explicit ports.
Solution
Updated the updatePort method to use raw URI components that preserve original encoding:
-
getUserInfo()→getRawUserInfo() -
getPath()→getRawPath() -
getQuery()→getRawQuery() -
getFragment()→getRawFragment()
The method now manually constructs URLs using a StringBuilder to avoid the automatic encoding performed by the URI constructor.
Testing
- All existing tests continue to pass (12/12)
- Added
testValidatePreservesUrlEncodingInQueryto prevent regression - Verified the original issue example now works correctly
- Tested edge cases including encoded userinfo, fragments, and multiple encoded characters
Example that now works correctly:
String url1 = "https://someurl.com/somepath?param1=client%3AAnonymous";
String url2 = "https://someurl.com:443/somepath?param1=client%3AAnonymous";
String signature = "PM+bjB+ITJ9a3LIYStKWOTMZMlU=";
RequestValidator r = new RequestValidator("1234567890");
// Both now return true
r.validate(url1, new HashMap<>(), signature); // true
r.validate(url2, new HashMap<>(), signature); // true
Fixes #601.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.
@manisha1997 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs.
I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review.
