Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent duplicated encoding of setPath(), stripPrefix() in mvc #3658

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Prevent duplicated encoding of setPath(), stripPrefix() in mvc #3658

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2241fc2
Prevent double encoding in setPath method
raccoonback Jan 5, 2025
e9555a1
Prevent double encoding in stripPrefix method
raccoonback Jan 5, 2025
47d74f6
Prevent double encoding in removeRequestParameter method
raccoonback Jan 5, 2025
e4b4a0a
isEqualTo -> hasToString
raccoonback Jan 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions .../main/java/org/springframework/cloud/gateway/server/mvc/filter/BeforeFilterFunctions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,10 +215,12 @@ public static Function<ServerRequest, ServerRequest> removeRequestParameter(Stri
MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>(request.params());
queryParams.remove(name);

MultiValueMap<String, String> encodedQueryParams = UriUtils.encodeQueryParams(queryParams);

// remove from uri
URI newUri = UriComponentsBuilder.fromUri(request.uri())
.replaceQueryParams(unmodifiableMultiValueMap(queryParams))
.build()
.replaceQueryParams(unmodifiableMultiValueMap(encodedQueryParams))
.build(true)
Comment on lines +218 to +223
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change only re-encodes request parameters, and does not affect other segments such as the request path.

.toUri();

// remove resolved params from request
Expand Down Expand Up @@ -375,9 +377,11 @@ public static Function<ServerRequest, ServerRequest> setPath(String path) {
return request -> {
Map<String, Object> uriVariables = MvcUtils.getUriTemplateVariables(request);
URI uri = uriTemplate.expand(uriVariables);
String newPath = uri.getRawPath();

URI prefixedUri = UriComponentsBuilder.fromUri(request.uri()).replacePath(newPath).build().toUri();
URI prefixedUri = UriComponentsBuilder.fromUri(request.uri())
.replacePath(uri.getRawPath())
.build(true)
.toUri();
Comment on lines +381 to +384
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The modified path is already encoded, so no additional encoding will be applied.
Furthermore, other parts, such as request parameters, are not affected.

return ServerRequest.from(request).uri(prefixedUri).build();
};
}
Expand Down Expand Up @@ -432,7 +436,7 @@ public static Function<ServerRequest, ServerRequest> stripPrefix(int parts) {

URI prefixedUri = UriComponentsBuilder.fromUri(request.uri())
.replacePath(newPath.toString())
.build()
.build(true)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The stripped path is already encoded, so no additional encoding will be applied.
Furthermore, other parts such as request parameters are not affected.

.toUri();
return ServerRequest.from(request).uri(prefixedUri).build();
};
Expand Down
150 changes: 150 additions & 0 deletions .../java/org/springframework/cloud/gateway/server/mvc/filter/BeforeFilterFunctionsTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,4 +107,154 @@ void rewriteRequestParameterWithEncodedPath() {
assertThat(result.uri().toString()).hasToString("http://localhost/path/%C3%A9/last?foo=replacement");
}

@Test
void setPath() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/new/path");
}

@Test
void setEncodedPath() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.setPath("/new/é").apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/new/%C3%A9");
}

@Test
void setPathWithParameters() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
.queryParam("foo", "bar")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/new/path?foo=bar");
}

@Test
void setPathWithEncodedParameters() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
.queryParam("foo[]", "bar[]")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/new/path?foo%5B%5D=bar%5B%5D");
}

@Test
void removeRequestParameter() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
.queryParam("foo", "bar")
.queryParam("baz", "qux")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);

assertThat(result.param("foo")).isEmpty();
assertThat(result.param("baz")).isPresent().hasValue("qux");
assertThat(result.uri().toString()).hasToString("http://localhost/path?baz=qux");
}

@Test
void removeEncodedRequestParameter() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
.queryParam("foo[]", "bar")
.queryParam("baz", "qux")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo[]").apply(request);

assertThat(result.param("foo[]")).isEmpty();
assertThat(result.param("baz")).isPresent().hasValue("qux");
assertThat(result.uri().toString()).hasToString("http://localhost/path?baz=qux");
}

@Test
void removeRequestParameterWithEncodedRemainParameters() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
.queryParam("foo", "bar")
.queryParam("baz[]", "qux[]")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);

assertThat(result.param("foo")).isEmpty();
assertThat(result.param("baz[]")).isPresent().hasValue("qux[]");
assertThat(result.uri().toString()).hasToString("http://localhost/path?baz%5B%5D=qux%5B%5D");
}

@Test
void removeRequestParameterWithEncodedPath() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/é")
.queryParam("foo", "bar")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);

assertThat(result.param("foo")).isEmpty();
assertThat(result.uri().toString()).hasToString("http://localhost/%C3%A9");
}

@Test
void stripPrefix() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/depth3");
}

@Test
void stripPrefixWithEncodedPath() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3/é")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);

assertThat(result.uri().toString()).hasToString("http://localhost/depth3/%C3%A9");
}

@Test
void stripPrefixWithEncodedParameters() {
MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3")
.queryParam("baz[]", "qux[]")
.buildRequest(null);

ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());

ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);

assertThat(result.param("baz[]")).isPresent().hasValue("qux[]");
assertThat(result.uri().toString()).hasToString("http://localhost/depth3?baz%5B%5D=qux%5B%5D");
}

}
Loading