eclipse-ee4j / eclipse-ee4j/jersey
JerseyUriBuilder incorrectly encodes fragment using application/x-www-form-urlencoded rules
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
The Javadoc for `javax.ws.rx.core.UriBuilder`:
> Builder methods perform contextual encoding of characters not permitted in the corresponding URI component following the rules of the `application/x-www-form-urlencoded` media type for query parameters and RFC 3986 for all other components.
https://docs.oracle.com/javaee/7/api/javax/ws/rs/core/UriBuilder.html
But `org.glassfish.jersey.uri.internal.JerseyUriBuilder` applies the rules for `application/x-www-form-urlencoded` for the fragment component rather than RFC 3986.
RFC 3986 defines the following syntax:
fragment = *( pchar / "/" / "?" )
pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
pct-encoded = "%" HEXDIG HEXDIG
sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
/ "*" / "+" / "," / ";" / "="
https://tools.ietf.org/html/rfc3986#section-3.5
The RFC 3986 syntax permits most of the delimiters that are percent encoded by the `application/x-www-form-urlencoded` rules.
Example:
System.out.println( UriBuilder.fromPath("http://test.com").fragment("/?:@valid42-._~%20!$&'()*+,;=").build() );
Expected:
http://test.com#/?:@valid42-._~%20!$&'()*+,;=
Actual:
http://test.com#%2F%3F%3A%40valid42-._~%20%21%24&%27%28%29%2A+%2C%3B=
Contributor guide
Assessment
This issue has not been assessed yet.