Manual Request Editor: GET parameters in "Table (adv)" view get url encoded (mostly)
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
Describe the bug
In the Manual Request Editor, adding/modifying GET parameters in the "Table (adv)" view, will result in those parameters being url encoded when they shouldn't be. There are exceptions though, which makes this view completely unusable. For example, the "+" character will not be url encoded but translated to a space. Adding a "%2B" for the "+" character will also not work, since that will get url encoded as well.
To Reproduce
Steps to reproduce the behavior:
- Open a request with GET parameters in the Manual Request Editor
- Change view to "Table (adv)"
- Add special characters to the value of one the parameters
- Add a "+" character to the value of one the parameters
Expected behavior
The request gets sent as-is, without any url encoding applied since this is what the "Table (adv)" view is for.
Actual behavior
All special characters get url encoded, except for the "+" character, which will be translated to a space.
Software versions
- ZAP: 2.8.0
- OS: Linux (Gentoo)
- Java: OpenJDK 64-Bit Server VM 11.0.4_p11 (build 11.0.4+11, mixed mode, sharing)
- Browser: Firefox 69.0.1
Additional context
Generally it would be nice to have a traditional "Table" view that properly applies url encoding to all GET parameters and a "Table (adv)" view that doesn't touch the parameters at all. The way it is now, the "Table (adv)" view is mostly useless and, if not fixed, should better be removed for the time being as to not cause headaches for its users.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in the Manual Request Editor using the "Table (adv)" view and special characters, including "+" and "%2B". Trace how GET parameters are converted before the request is sent. Done means the advanced view preserves parameter values as entered, including plus signs, without unintended URL encoding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- desktop
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100