Id's within entity _links are not correctly URL encoded [DATAREST-763]

Andrew Walters opened DATAREST-763 and commented

Encountered this as a result of some poorly configured keys but looks to be a potentially nasty exploitable defect.

Given an entity with a String based @Id

I would expect the _links containing the @Id to use the URL encoded version of the @Id to avoid potential exploits.

The current behaviour incorrectly fails to encode the full @Id which could potentially result in exploitable behaviour - e.g. by referencing a different resource (as we can switch paths using ".."), cause a slowdown (by adding a large ?size and relative pathing to a large collection view) etc.

Assuming a base href of "http://.../api/users":

{
  "id": "../someOtherResource/id",
  "_links": {
    "self": {
      "href": "http://.../api/someOtherResource/id"
    },
    "user": {
      "href": "http://.../api/someOtherResource/id"
    }
  }
}

{
  "id": "../someOtherResource?size=10000",
  "_links": {
    "self": {
      "href": "http://.../api/someOtherResource?size=10000"
    },
    "user": {
      "href": "http://.../api/someOtherResource?size=10000"
    }
  }
}

Note that the generated self/user references are now subverted to point to a completely different resource and operations relying on these links will now be performed on the completely unrelated resource.

An exploit like this could potentially cause significant damage and the solution should simply be to ensure correct url encoding of the @Id when generating the links for the entity.

I appreciate this can be mitigated through validation/restriction of the @Id but there are valid cases where an Id may contain characters which would otherwise not be valid in a URL which should be URL encoded

Affects: 2.4.2 (Gosling SR2)

Referenced from: pull request https://github.com/spring-projects/spring-data-rest/pull/208