Aias00 opened a new issue, #7464:
URL: https://github.com/apache/shenyu/issues/7464
## Description
The Spring SDK request proxy appends `@RequestParam` keys and values
directly into the URL. `RequestParamParameterProcessor` builds the query string
with `urlResult.append(key).append("=").append(value)`, so reserved characters
are interpreted as URL syntax instead of parameter data.
## Location
-
`shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java:64`
- Caller path:
`shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/proxy/ShenyuClientMethodHandler.java:92`
## Impact
A call such as `get(@RequestParam("q") String q)` with `q = "a&admin=true"`
sends `?q=a&admin=true`, changing one logical parameter into two. Values
containing spaces, `=`, `%`, or non-ASCII characters can also be malformed or
parsed differently by the gateway/upstream.
## Suggested fix
Percent-encode query parameter names and values before appending them. Add
regression coverage for reserved characters, spaces, existing query strings,
and map-valued `@RequestParam`.
## Related existing issues
Different from #6489 (composition order) and #6751 (different path builder).
## Reviewed Revision And Validation
Apache ShenYu 2.7.2-SNAPSHOT, master at
a89b6a2338c24e978428b731e8f1edce86022418. Severity: medium. Confidence: high.
Current Spring SDK processor harness reproduced query-value splitting. See
registration/counterchecks.md and harnesses/SpringSdkHarness.java.
Current source references:
-
`shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java:64`
-
`shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/proxy/ShenyuClientMethodHandler.java:92`
No implementation fix or full deployed end-to-end validation was performed
by this review. Source-flow and runtime evidence are distinguished above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
