eclipse-vertx / eclipse-vertx/vertx-openapi

Double URL Decoding of Query Parameters

Open
#117 6 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
15
Forks
19
PR merge metrics
No merged PRs in 30d

Description

### Version

5.0.4

### Context

When specifying query parameters that need to be URL-encoded, the `extractQuery` function of `RequestUtils` attempts URL decoding of the parameter value. This is incorrect, as parameters are already URL-decoded when retrieving them them from the `HttpServerRequest` (in `vertx-core/io.vertx.core.http.impl.HttpUtils::params`).

This behavior is likely to go undetected, as URL decoding will only lead to unexpected results if the decoded parameter value include `+` characters or fail if the parameter value contains `%`. We ran into the latter case.

### Steps to reproduce

1. Define an endpoint with a query parameter
2. Send a request where the parameter value includes the `%` character (encoded `%25`)
3. Observe

```
io.vertx.openapi.validation.ValidatorException: Can't decode URL value: ((name!=Invalid) AND (name!=Error) and (name like 'thi%') and ( name like '_hin_' ) ) or name=thing
at io.vertx.openapi.validation.RequestUtils.decodeUrl(RequestUtils.java:175) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.lambda$joinFormValues$6(RequestUtils.java:155) ~[vertx-openapi-5.0.4.jar:5.0.4]
[...]
at io.vertx.openapi.validation.RequestUtils.joinFormValues(RequestUtils.java:155) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extractQuery(RequestUtils.java:131) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extract(RequestUtils.java:87) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extract(RequestUtils.java:55) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.ext.web.openapi.router.RouterBuilder.lambda$create$0(RouterBuilder.java:61) ~[vertx-web-openapi-router-5.0.4.jar:5.0.4]
at io.vertx.ext.web.openapi.router.impl.RouterBuilderImpl.lambda$createRouter$3(RouterBuilderImpl.java:131) ~[vertx-web-openapi-router-5.0.4.jar:5.0.4]
[...]
Caused by: java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: "')"
at java.base/java.net.URLDecoder.decode(URLDecoder.java:243) ~[?:?]
at io.vertx.openapi.validation.RequestUtils.decodeUrl(RequestUtils.java:173) ~[vertx-openapi-5.0.4.jar:5.0.4]
... 68 more
```

### Do you have a reproducer?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.