Vincenzo Lombardo created NIFI-16501:
----------------------------------------
Summary: StandardHttpUriBuilder does not encode reserved
characters in query parameter values
Key: NIFI-16501
URL: https://issues.apache.org/jira/browse/NIFI-16501
Project: Apache NiFi
Issue Type: Improvement
Components: Extensions
Reporter: Vincenzo Lombardo
StandardHttpUriBuilder.build() joins query parameter names and values without
encoding and passes the result to the multi-argument java.net.URI constructor.
That constructor only quotes characters that are illegal in a URI query, so
reserved characters such as \{{&}}, \{{+}} and \{{=}} are passed through
unchanged.
As a result, a value containing \{{&}} is split into separate parameters, and a
value containing \{{+}} is decoded as a space by most servers. For example,
addQueryParameter("ref", "feature&test") produces \{{?ref=feature&test}}, which
the server reads as ref=feature plus an empty test parameter.
Callers cannot work around this by encoding values before calling
addQueryParameter(), because the \{{%}} characters are then encoded again
(\{{%26}} becomes \{{%2526}}).
This currently limits the Bitbucket and Azure DevOps Flow Registry Clients,
which document that branch and bucket names must not contain these characters,
and the Gitea Flow Registry Client proposed in NIFI-16441 (PR #11791). Other
components using HttpUriBuilder.addQueryParameter(), such as the Salesforce,
Shopify, Zendesk and Airtable processors and cluster request replication, are
affected the same way.
Proposed fix: encode query parameter names and values with URLEncoder (UTF-8)
in StandardHttpUriBuilder, and build the URI from the encoded string instead of
passing the raw query to the multi-argument URI constructor. No current caller
of addQueryParameter() encodes values beforehand, so this does not introduce
double encoding. Unit tests should cover values containing &, +, =, spaces and
non-ASCII characters.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
