[
https://issues.apache.org/jira/browse/NIFI-16501?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vincenzo Lombardo updated NIFI-16501:
-------------------------------------
Status: Patch Available (was: Open)
> StandardHttpUriBuilder does not encode reserved characters in query
> parameter values
> -------------------------------------------------------------------------------------
>
> Key: NIFI-16501
> URL: https://issues.apache.org/jira/browse/NIFI-16501
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Extensions
> Reporter: Vincenzo Lombardo
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> StandardHttpUriBuilder.build() joins query parameter names and values without
> encoding and passes the result to the multi-argument java.net.URI
> constructor. That constructor only quotes characters that are illegal in a
> URI query, so reserved characters such as \{{&}}, \{{+}} and \{{=}} are
> passed through unchanged.
> As a result, a value containing \{{&}} is split into separate parameters, and
> a value containing \{{+}} is decoded as a space by most servers. For example,
> addQueryParameter("ref", "feature&test") produces \{{?ref=feature&test}},
> which the server reads as ref=feature plus an empty test parameter.
> Callers cannot work around this by encoding values before calling
> addQueryParameter(), because the \{{%}} characters are then encoded again
> (\{{%26}} becomes \{{%2526}}).
> This currently limits the Bitbucket and Azure DevOps Flow Registry Clients,
> which document that branch and bucket names must not contain these
> characters, and the Gitea Flow Registry Client proposed in NIFI-16441 (PR
> #11791). Other components using HttpUriBuilder.addQueryParameter(), such as
> the Salesforce, Shopify, Zendesk and Airtable processors and cluster request
> replication, are affected the same way.
> Proposed fix: encode query parameter names and values with URLEncoder (UTF-8)
> in StandardHttpUriBuilder, and build the URI from the encoded string instead
> of passing the raw query to the multi-argument URI constructor. No current
> caller of addQueryParameter() encodes values beforehand, so this does not
> introduce double encoding. Unit tests should cover values containing &, +, =,
> spaces and non-ASCII characters.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
