Aias00 opened a new issue, #7734: URL: https://github.com/apache/shenyu/issues/7734
### Current behavior RPC parameter transformation loses literal data by decoding before delimiting parameter pairs: - The form path calls `URLDecoder.decode()` on the complete body, then splits it with `BodyParamUtils.buildBodyParams()`. - The query path passes `URI.getQuery()` (already decoded) to `HttpParamConverter.ofString()`. That helper splits the decoded delimiters and URL-decodes each token again. A literal `%2B` can therefore become `+`, then a space. ### Locations / production flow - [RpcParamTransformPlugin.java:84–101](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-transform/src/main/java/org/apache/shenyu/plugin/transform/RpcParamTransformPlugin.java#L84) - [HttpParamConverter.java:67–90](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/utils/HttpParamConverter.java#L67) The plugin writes `Constants.PARAM_TRANSFORM`, which RPC proxy plugins consume as their argument JSON. The problem is data conversion on the configured RPC path, not HTTP upstream URI forwarding. ### Reproduction / validation A standalone Java probe compiled the current plugin, BodyParamUtils and HttpParamConverter and called the plugin's public `execute()` with a mock WebFlux exchange and a ShenyuContext: ```text Form input: value=a%26b%3Dc RPC_FORM={"value":"a","b":"c"} Raw query: ?value=a%26b%3Dc&plus=a%2Bb RPC_QUERY={"value":"a","b":"c","plus":"a b"} ``` Expected: `value` is the single string `a&b=c`; `plus` is `a+b`. The encoded ampersand must not become a separator. A separate reviewer initially distinguished the query path incorrectly, then independently verified Java URI.getQuery versus getRawQuery semantics and confirmed both failures. No live RPC service was needed to establish the transformed arguments. ### Impact / suggested fix Valid string arguments containing encoded delimiters or plus signs are changed, or split into extra fields, before RPC invocation. Split raw form/query pairs before decoding individual names/values once, or use the framework's parsed query/form data. Preserve empty values and the intended repeated-key contract. ### Related existing work Searched 3,103 historical issue titles, open PRs and live RpcParamTransformPlugin/encoding queries. #2731 concerns GET requests labeled form-urlencoded not reading a body; #3158 concerns large JSON bodies; #7464 concerns SDK query construction; #7685 concerns RequestPlugin path re-encoding. None describes this RPC decode-before-split / double-decode corruption. ### Reviewed revision Apache ShenYu 2.7.2-SNAPSHOT, `master@66d7d954ca37d651a5ad916f988a8081157a7ab4`. Priority P2 / Medium. Unit-test and CI issue categories excluded. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
