eclipse-ee4j / eclipse-ee4j/jersey

JerseyUriBuilder incorrectly encodes fragment using application/x-www-form-urlencoded rules

Open
#4,018 5 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

The Javadoc for `javax.ws.rx.core.UriBuilder`:

> Builder methods perform contextual encoding of characters not permitted in the corresponding URI component following the rules of the `application/x-www-form-urlencoded` media type for query parameters and RFC 3986 for all other components.

https://docs.oracle.com/javaee/7/api/javax/ws/rs/core/UriBuilder.html

But `org.glassfish.jersey.uri.internal.JerseyUriBuilder` applies the rules for `application/x-www-form-urlencoded` for the fragment component rather than RFC 3986.

RFC 3986 defines the following syntax:

fragment = *( pchar / "/" / "?" )
pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
pct-encoded = "%" HEXDIG HEXDIG
sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
/ "*" / "+" / "," / ";" / "="

https://tools.ietf.org/html/rfc3986#section-3.5

The RFC 3986 syntax permits most of the delimiters that are percent encoded by the `application/x-www-form-urlencoded` rules.

Example:

System.out.println( UriBuilder.fromPath("http://test.com").fragment("/?:@valid42-._~%20!$&'()*+,;=").build() );

Expected:

http://test.com#/?:@valid42-._~%20!$&'()*+,;=

Actual:

http://test.com#%2F%3F%3A%40valid42-._~%20%21%24&%27%28%29%2A+%2C%3B=

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.