OpenFeign / OpenFeign/feign

Request parameters are not correctly pct-encoded in the Request Line

Open
#1,853 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
9.8k
Forks
1.9k
Avg merge
1d 2h
Merged PRs (30d)
41

Description

Hi,

I have noticed that when a request parameter contains parameters that "look" URL-encoded, feign skips encoding the % character.
For a basic example such as :
@RequestLine("GET /path?param={param}") void test(@Param("param") String value);
I have reproduced the below encoding examples :

        "label" => "label" (ok)
        "labelWithEscaped\\_Symbol" => "labelWithEscaped%5C_Symbol" (ok)
        "labelWithEscaped\\%Symbol" => "labelWithEscaped%5C%25Symbol" (ok)
        "filterWith%Symbol" => "filterWith%25Symbol" (ok)
        "filterWith%25Symbol" => "filterWith%25Symbol" (NOK - same encoding as above)
        "%2500%25" => "%2500%25" (NOK - % should be encoded)
        "%00%" => "%00%25" (NOK - first % should be encoded)
        "%25%20GA%20%25", "%25%20GA%20%25"  (NOK - % should be encoded)
        "%25 %25GA%25 %25", "%2525%20%2525GA%2525%20%2525" (OK; the presence of a reserved char other than % seem to force the whole value to be correctly encoded)

I have attached a small case to reproduce it here :
feign-query-bug.zip

I also note that there is a similar issue here : #1225
What I can observe is :

  • The issue is still active at head (feign-core 12.1)
  • The behavior has become a bit 'random' depending on the variable value between versions 10.1.0 and 11.8. It seems now that reserved characters force the "%" characters to be properly tackled.
  • The issue appears whether the Request parameter is used as a query parameter (/path?param={value}) or in the path (/path/{value})

I first observed this in a service where the end user can use queries to search in a repository. The service calls another service using feign, and '%' can be used as a wildcard parameter. Anytime '%00' is used for example, the resulting query is incorrect.
But in general, when the Request Parameter value comes from uncontrolled input, which is frequent it can contain any sort of URL-encoded like value.

Is there any chance to see this fixed ?

Thanks,

Adrien

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the examples from the issue with the attached feign-query-bug.zip case against feign-core 12.1, then inspect the request-parameter encoding path for both query and path values. Done means percent signs in URL-encoded-looking input are encoded consistently without breaking the other examples, with regression coverage for the reported cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.