eclipse-vertx / eclipse-vertx/vertx-openapi
Double URL Decoding of Query Parameters
- Dominant language
- Java
- Stars
- 15
- Forks
- 19
- PR merge metrics
- No merged PRs in 30d
Description
### Version
5.0.4
### Context
When specifying query parameters that need to be URL-encoded, the `extractQuery` function of `RequestUtils` attempts URL decoding of the parameter value. This is incorrect, as parameters are already URL-decoded when retrieving them them from the `HttpServerRequest` (in `vertx-core/io.vertx.core.http.impl.HttpUtils::params`).
This behavior is likely to go undetected, as URL decoding will only lead to unexpected results if the decoded parameter value include `+` characters or fail if the parameter value contains `%`. We ran into the latter case.
### Steps to reproduce
1. Define an endpoint with a query parameter
2. Send a request where the parameter value includes the `%` character (encoded `%25`)
3. Observe
```
io.vertx.openapi.validation.ValidatorException: Can't decode URL value: ((name!=Invalid) AND (name!=Error) and (name like 'thi%') and ( name like '_hin_' ) ) or name=thing
at io.vertx.openapi.validation.RequestUtils.decodeUrl(RequestUtils.java:175) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.lambda$joinFormValues$6(RequestUtils.java:155) ~[vertx-openapi-5.0.4.jar:5.0.4]
[...]
at io.vertx.openapi.validation.RequestUtils.joinFormValues(RequestUtils.java:155) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extractQuery(RequestUtils.java:131) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extract(RequestUtils.java:87) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.openapi.validation.RequestUtils.extract(RequestUtils.java:55) ~[vertx-openapi-5.0.4.jar:5.0.4]
at io.vertx.ext.web.openapi.router.RouterBuilder.lambda$create$0(RouterBuilder.java:61) ~[vertx-web-openapi-router-5.0.4.jar:5.0.4]
at io.vertx.ext.web.openapi.router.impl.RouterBuilderImpl.lambda$createRouter$3(RouterBuilderImpl.java:131) ~[vertx-web-openapi-router-5.0.4.jar:5.0.4]
[...]
Caused by: java.lang.IllegalArgumentException: URLDecoder: Illegal hex characters in escape (%) pattern - Error at index 0 in: "')"
at java.base/java.net.URLDecoder.decode(URLDecoder.java:243) ~[?:?]
at io.vertx.openapi.validation.RequestUtils.decodeUrl(RequestUtils.java:173) ~[vertx-openapi-5.0.4.jar:5.0.4]
... 68 more
```
### Do you have a reproducer?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.