eclipse-ee4j / eclipse-ee4j/jersey

Building EventSource via WebTarget with params containing "%" fails with UnknownFormatConversionException

Open
#3,531 7 comments 0 reactions 0 assignees View on GitHub
Component: media Priority: Major Type: Bug
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

When creating an EventSource object using a WebTarget with queryParams

Reproduction (will attach repro example in comments)
1) Create a WebTarget object from a URI
2) use the `.queryParam` method on the WebTarget with a param containing characters that will be HTTP encoded as strings containing `%` chars to obtain a new WebTarget
(calling `target.getUri().toASCIIString()` on the new target will now return a string containing `%`)
3) Pass the target to `EventSource.target()` to obtain a `EventSource.Builder` object.
4) Call the `build()` method on the `Builder` object.

An UnknownFormatConversionException will be thrown.

Root cause:

When an EventSource object is constructed, it creates a `ScheduledExecutorService` object, using a Guava `ThreadFactoryBuilder`.

When the `ThreadFactoryBuilder` is being created, the `setNameFormat()` method is called with a string representation of the EventSource, generated by the `createDefaultName` method. This string includes the WebTarget's URI, which—under these conditions—contains `%` chars. (see [https://github.com/jersey/jersey/blob/8dd1fea1c82adea2d8ef3ce5ebd96d8b4b3c4ca7/media/sse/src/main/java/org/glassfish/jersey/media/sse/EventSource.java#L387](https://github.com/jersey/jersey/blob/8dd1fea1c82adea2d8ef3ce5ebd96d8b4b3c4ca7/media/sse/src/main/java/org/glassfish/jersey/media/sse/EventSource.java#L387) )

`setNameFormat` is expecting a `String.format`-style string, and the ThreadFactoryBuilder will eventually use this string with String.format, expecting it to contain one `%d` (used for displaying current thread number). Since the string passed to setNameFormat contains other characters considered special for `String.format()`, the call to `format` will fail.

Proposed fix:

Before passing the EventSource's name to `setNameFormat()`, the string should be escaped against `String.format()` special characters.
#### Environment
Mac OS X 10.11.6
java version "1.8.0_121"
Java(TM) SE Runtime Environment (build 1.8.0_121-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)
#### Affected Versions
[2.25.1]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.