spring-projects / spring-projects/spring-hateoas

ControllerLinkBuilder link expansion leads to multiple url-encoding of parameters

Open
#559 4 comments 19 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.1k
Forks
476
PR merge metrics
No merged PRs in 30d

Description

When building a link with methodOn, and supplying values for some parameters but not all, a link template with variables for the remaining parameters is created, while the supplied values are already expanded. When expanding the resulting template, the initially supplied values are url-encoded again, leading to invalid URLs. This affects explicitly calling expand() of course, but also the pagination links of the PagedResourcesAssembler from Spring Data. Here is some code example:

    @GetMapping("/")
    public Resource test(
            @RequestParam(name = "date1", required = false) @DateTimeFormat(iso = DATE_TIME) Date date1,
            @RequestParam(name = "date2", required = false) @DateTimeFormat(iso = DATE_TIME) Date date2) {
        Link template = linkTo(methodOn(TestController.class).test(date1, null)).withRel("template");
        Link expanded = linkTo(methodOn(TestController.class).test(date1, null)).withRel("expanded").expand();
        return new Resource("", template, expanded);
    }

This leads to following response:

{
    "_links": {
        "expanded": {
            "href": "http://localhost:8080/?date1=2017-03-21T19:20:20.000%25252B0000"
        },
        "template": {
            "href": "http://localhost:8080/?date1=2017-03-21T19:20:20.000%2B0000{&date2}",
            "templated": true
        }
    },
    "content": ""
}

As you see, the + in the date has been encoded correctly in the template, but the %-sign has been encoded again in the expanded link, even twice as shown by the additional 25.

I have a runnable example with a test case in this repository

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the linked runnable example and its test case, then trace the ControllerLinkBuilder methodOn and expand() entry points. Compare the template and expanded links for the supplied date parameter, including pagination links produced by PagedResourcesAssembler. Done means supplied values are URL-encoded only once while remaining parameters still produce a valid link template.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.