twilio / twilio/twilio-java

RequestValidator.validate incorrectly decodes query string when removing port

Open
#601 4 comments 7 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

status: help wanted TwiDi-InReview type: bug
Dominant language
Java
Stars
527
Forks
453
Avg merge
10h 59m
Merged PRs (30d)
6

Description

Issue Summary

When removing the port RequestValidator.validate incorrectly decodes the path, query, and fragment.

e.g.

https://someurl.com:443/somepath?param1=client%3AAnonymous

is converted to

https://someurl.com/somepath?param1=client:Anonymous

https://github.com/twilio/twilio-java/blob/main/src/main/java/com/twilio/security/RequestValidator.java#L145-L147

A suggestion is to consider using getRawPath, getRawQuery, and getRawFragment instead.

Steps to Reproduce
  1. The snippet below demonstrates the issue. The validate output should be the same for both URLs.
Code Snippet
import java.net.URI;
import java.util.HashMap;
import com.twilio.security.RequestValidator;
...
        String url1 = "https://someurl.com/somepath?param1=client%3AAnonymous";
        String url2 = "https://someurl.com:443/somepath?param1=client%3AAnonymous";
        String signature = "PM+bjB+ITJ9a3LIYStKWOTMZMlU=";
        RequestValidator r= new RequestValidator("1234567890");
        System.out.println("valid without port?: " + r.validate(url1, new HashMap<>(), signature));
        System.out.println("valid with port?: " + r.validate(url2, new HashMap<>(), signature));
Exception/Log
valid without port?: true
valid with port?: false
Technical details:
  • twilio-java version: 7.55.3 (latest as of submission)
  • java version: 1.8.0_161

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.