zaproxy / zaproxy/zaproxy

Manual Request Editor: GET parameters in "Table (adv)" view get url encoded (mostly)

Open
#5,606 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Describe the bug
In the Manual Request Editor, adding/modifying GET parameters in the "Table (adv)" view, will result in those parameters being url encoded when they shouldn't be. There are exceptions though, which makes this view completely unusable. For example, the "+" character will not be url encoded but translated to a space. Adding a "%2B" for the "+" character will also not work, since that will get url encoded as well.

To Reproduce
Steps to reproduce the behavior:

  1. Open a request with GET parameters in the Manual Request Editor
  2. Change view to "Table (adv)"
  3. Add special characters to the value of one the parameters
  4. Add a "+" character to the value of one the parameters

Expected behavior
The request gets sent as-is, without any url encoding applied since this is what the "Table (adv)" view is for.

Actual behavior
All special characters get url encoded, except for the "+" character, which will be translated to a space.

Software versions

  • ZAP: 2.8.0
  • OS: Linux (Gentoo)
  • Java: OpenJDK 64-Bit Server VM 11.0.4_p11 (build 11.0.4+11, mixed mode, sharing)
  • Browser: Firefox 69.0.1

Additional context
Generally it would be nice to have a traditional "Table" view that properly applies url encoding to all GET parameters and a "Table (adv)" view that doesn't touch the parameters at all. The way it is now, the "Table (adv)" view is mostly useless and, if not fixed, should better be removed for the time being as to not cause headaches for its users.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in the Manual Request Editor using the "Table (adv)" view and special characters, including "+" and "%2B". Trace how GET parameters are converted before the request is sent. Done means the advanced view preserves parameter values as entered, including plus signs, without unintended URL encoding.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
desktop
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.