UrlPathHelper is too aggressive decoding URLs [SPR-6291]

[spring-projects-issues]

Arjen Poutsma opened SPR-6291 and commented

The UrlPathHelper, used by various other MVC components such as DispatcherServlet, is too aggressive when it decoding request URLs.

For instance, it decodes http://example.com/foo+bar as http://example.com/foo bar, while this is not correct according to RFC 2396.

---

Issue Links:

• RestTemplate should encode the url variables [SPR-5516] #10187 RestTemplate should encode the url variables

Referenced from: commits c5c1d70, 077055c

1 votes, 5 watchers

[spring-projects-issues]

Pavel Halas commented

Hi Arjen,

I'm struggling with UTF-8 within URL and realized there might be problem in UriUtils.decode() method. The problem is that it decodes non-encoded strings. I would say the following test case should pass:

assertEquals("Invalid encoded result", "T\u014dky\u014d", UriUtils.decode("T\u014dky\u014d", ENC));

Please check the test case:

1. UriUtils.encodeHttpUrl("http://localhost:8080/test/T\u014dky\u014d", "UTF-8") gives http://localhost:8080/test/T%C5%8Dky%C5%8D
2. Paste such an address in the browser (Firefox, Chrome expands it to full UTF-8, IE8 lets it encoded)
3. Pause the app before decoding (in UrlPathHelper.decodeRequestString())

I can see 'source' (requestURI) to be the full UTF-8 string as I would expect. Then, the UriUtils comes to play and the request URI gets screwed.

BTW, URLDecoder works the expected way: java.net.URLDecoder.decode("http://localhost:8080/test/T\u014dky\u014d");

Of course, I might miss something important... What do you think?
Thank you.
Pavel

[spring-projects-issues]

Pavel Halas commented

Just to make sure, I'm using Spring 3.0.4.RELEASE.

[spring-projects-issues]

Arjen Poutsma commented

This should now be fixed.

[spring-projects-issues]

Grzegorz Borkowski commented

Hi Arjen, I had exactly the same problem as Pavel had. I used Spring 3.0.3, so I upgraded to 3.0.5 to get it fixed, but the problem is still there even in 3.0.5. All URLs containing non-ASCII characters get properly decoded by Tomcat, but then Spring tries to decode them once again with UrlPathHelper.decodeRequestString() and they get scrumbled completely.