Vinz2168 opened a new pull request, #11844: URL: https://github.com/apache/nifi/pull/11844
# Summary [NIFI-16501](https://issues.apache.org/jira/browse/NIFI-16501) `StandardHttpUriBuilder.build()` joined query parameter names and values without encoding and passed the result to the multi-argument `java.net.URI` constructor, which only quotes characters that are illegal in a query. Reserved characters such as `&`, `+` and `=` were passed through unchanged, so a value like `feature&test` was split into two parameters and `a+b` was read as `a b` by most servers. Callers could not work around this by encoding values beforehand, because the `%` character was then encoded again. This limitation is currently documented for branch and bucket names in the Bitbucket and Azure DevOps Flow Registry Clients, and also applies to the Gitea client proposed in NIFI-16441 (#11791). Changes: - `StandardHttpUriBuilder` encodes query parameter names and values using `URLEncoder` with UTF-8, with spaces written as `%20` instead of `+` to keep the previous behavior for spaces. The URI is built without the query using the multi-argument constructor, so path handling is unchanged, and the encoded query is then appended. - `StandardHttpReplicationClient` previously read the decoded query from the replicated request URI and passed the decoded values to the builder. It now splits the raw query and decodes each name and value with `URLDecoder`, so values are encoded exactly once. This keeps `+` read as a space, as with the original request, and also fixes values containing an encoded `&` or `=` being split during replication. No current caller of `addQueryParameter()` encodes values beforehand, so the change does not introduce double encoding in Bitbucket, Azure DevOps, Airtable, Shopify, Zendesk or Salesforce components. # Tracking Please complete the following tracking steps prior to pull request creation. ### Issue Tracking - [x] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created ### Pull Request Tracking - [x] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000` - [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000` - [x] Pull request contains [commits signed](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) with a registered key indicating `Verified` status ### Pull Request Formatting - [x] Pull Request based on current revision of the `main` branch - [x] Pull Request refers to a feature branch with one commit containing changes # Verification Please indicate the verification steps performed prior to pull request creation. ### Build - [ ] Build completed using `./mvnw clean install -P contrib-check` - [x] JDK 21 - [ ] JDK 25 ### Licensing - [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html) - [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files ### Documentation - [ ] Documentation formatting appears as expected in rendered files 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
