This is an automated email from the ASF dual-hosted git repository.
Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git
The following commit(s) were added to refs/heads/master by this push:
new 380afb5596 fix(sdk): percent-encode request param names and values in
query strings (#7492)
380afb5596 is described below
commit 380afb5596a1a4ee2465fc06a8ebce3bc07f23b6
Author: Sean-Walker0 <[email protected]>
AuthorDate: Sat Oct 10 13:51:53 2026 +0800
fix(sdk): percent-encode request param names and values in query strings
(#7492)
RequestParamParameterProcessor appended parameter keys and values
into the URL verbatim, so reserved characters were interpreted as
URL syntax instead of parameter data: a value like "a&admin=true"
was sent as one logical parameter becoming two, and spaces, '=' and
'%' could produce malformed or differently parsed URLs.
Encode both the key and the value with UriUtils.encodeQueryParam
before appending. Plain alphanumeric values are unchanged, and the
map-valued RequestParam branch is covered as well. Regression tests
use values with reserved characters, spaces, and a map with reserved
keys and values (red on the previous code, which appended them raw).
Fixes #7464
Co-authored-by: Sean-Walker0
<[email protected]>
---
.../annotation/RequestParamParameterProcessor.java | 6 +++++-
.../RequestParamParameterProcessorTest.java | 25 ++++++++++++++++++++++
2 files changed, 30 insertions(+), 1 deletion(-)
diff --git
a/shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java
b/shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java
index 981218836b..f575edbfaf 100644
---
a/shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java
+++
b/shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java
@@ -19,6 +19,7 @@ package org.apache.shenyu.sdk.spring.annotation;
import com.google.common.collect.Maps;
import java.lang.annotation.Annotation;
+import java.nio.charset.StandardCharsets;
import java.util.Map;
import org.apache.commons.lang3.StringUtils;
@@ -27,6 +28,7 @@ import org.apache.shenyu.sdk.core.common.RequestTemplate;
import static org.apache.shenyu.sdk.core.util.Util.checkState;
import org.apache.shenyu.sdk.spring.factory.AnnotatedParameterProcessor;
import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.util.UriUtils;
import org.springframework.web.multipart.MultipartFile;
/**
@@ -61,7 +63,9 @@ public class RequestParamParameterProcessor implements
AnnotatedParameterProcess
} else {
urlResult.append("?");
}
- urlResult.append(key).append("=").append(value);
+ urlResult.append(UriUtils.encodeQueryParam(String.valueOf(key),
StandardCharsets.UTF_8))
+ .append('=')
+ .append(UriUtils.encodeQueryParam(String.valueOf(value),
StandardCharsets.UTF_8));
});
shenyuRequest.setUrl(urlResult.toString());
return true;
diff --git
a/shenyu-sdk/shenyu-sdk-spring/src/test/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessorTest.java
b/shenyu-sdk/shenyu-sdk-spring/src/test/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessorTest.java
index 827f687ac4..9fc246b0a3 100644
---
a/shenyu-sdk/shenyu-sdk-spring/src/test/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessorTest.java
+++
b/shenyu-sdk/shenyu-sdk-spring/src/test/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessorTest.java
@@ -53,6 +53,31 @@ public class RequestParamParameterProcessorTest {
this.method2 = clazz.getMethod("method2", Map.class);
}
+ @Test
+ public void processArgumentEncodesReservedCharactersTest() {
+ RequestTemplate template = new RequestTemplate(Void.class, method1,
"method1", "/dev/url/param", "", "/path", ShenyuRequest.HttpMethod.GET, null,
null, null);
+ this.request = ShenyuRequest.create(ShenyuRequest.HttpMethod.POST,
template.getUrl() + template.getPath(), Maps.newHashMap(), "", "test",
template);
+ final RequestParam param = spy(RequestParam.class);
+ when(param.value()).thenReturn("q");
+
+ processor.processArgument(request, param, "a&admin=true 100%");
+
+ assertTrue(request.getUrl().endsWith("q=a%26admin%3Dtrue%20100%25"),
"query param value must be percent-encoded: " + request.getUrl());
+ }
+
+ @Test
+ public void processArgumentMapValuesAreEncodedTest() {
+ RequestTemplate template = new RequestTemplate(Void.class, method2,
"method2", "/dev/url/param", "", "/path", ShenyuRequest.HttpMethod.GET, null,
null, null);
+ this.request = ShenyuRequest.create(ShenyuRequest.HttpMethod.POST,
template.getUrl() + template.getPath(), Maps.newHashMap(), "", "test",
template);
+ final RequestParam param = spy(RequestParam.class);
+
+ Map<String, Object> params = Maps.newHashMap();
+ params.put("k&y", "v=l");
+ processor.processArgument(request, param, params);
+
+ assertTrue(request.getUrl().contains("k%26y=v%3Dl"), "map keys and
values must be percent-encoded: " + request.getUrl());
+ }
+
@Test
public void processArgumentNullTest() {
RequestTemplate template = new RequestTemplate(Void.class, method1,
"method1", "/dev/url/param", "", "/path", ShenyuRequest.HttpMethod.GET, null,
null, null);
