netliomax25-code opened a new pull request, #2748:
URL: https://github.com/apache/groovy/pull/2748
appendQuery rebuilds the request URI with the multi-argument URI
constructor, which takes decoded components, so passing uri.path and uri.query
decodes every percent escape and re-emits it literally: a path segment of a%2Fb
turns into two segments, %2e%2e turns into a real dot segment, and an existing
query value of a%26admin%3D1 splits off a second parameter. That also weakens
confineToBaseUri, since resolveUri runs enforceConfinement before appendQuery
and that check deliberately compares raw path segments, so get('..%2Fadmin') {
query page: 1 } passes confinement and is then sent as /api/v2/../admin.
Reassembling from the raw components leaves everything except the query
untouched; the three new tests fail on the current code, and the existing
queryDslUsesRfc3986StyleEncoding was asserting against requestURI.query, which
decoded once and masked the DSL escapes being encoded twice, so its fixture now
reads rawQuery.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
