cloudbase-ai opened a new issue, #7900: URL: https://github.com/apache/shenyu/issues/7900
### Bug On current master (`fda742c48e7f553c9964cf74b36732326d0fde00`), the paramMapping plugin changes unrelated valueless form parameters into empty-string values while applying a mapping. For `Content-Type: application/x-www-form-urlencoded`, send `flag` and configure a rule that adds `injected=yes`. Expected serialized form: `flag&injected=yes`. Actual: `flag=&injected=yes`. Likewise `flag&flag=&flag=value` becomes `flag=&flag=&flag=value&injected=yes`. Spring's form reader/writer distinguish a null (no `=`) value from an empty-string value (`=`). An unrelated mapping should preserve that distinction and repeated-value order. ### Reproduction evidence Regression tests invoke the real `FormDataOperator.apply` with Spring form codecs and consume the downstream request body. Three new cases fail on current master (valueless field, mixed repeated values, encoded key without a value); the empty-string control passes. This is payload corruption, not an established current NPE: the generic Gson adapter currently masks nulls by converting them to empty strings. ### Cause and scoped repair `FormDataOperator.toLinkedMultiValueMap` uses `GsonUtils.getGson()`, whose `StringTypeAdapter.read` explicitly returns `""` for JSON null. Preserve nulls in this form-specific deserialization without changing the global adapter or other plugins. `apply` also manually URL-encodes every value, creates a second serialized String and byte array, and sets Content-Length before `FormHttpMessageWriter` serializes the actual form again and sets its actual length. This duplicate preparation does not encode keys, and would throw on null values once they are correctly preserved. Delete it and let the existing writer own serialization, charset and byte length. No new dependency or serializer framework is needed. ### Validation scope Cover absent versus empty values, repeated values/order, encoded/unicode keys and reserved characters, UTF-8 and non-UTF-8 charsets, actual encoded byte length, addition/removal/rename behavior, and a real local HTTP forwarding check. Leave global Gson semantics and unrelated request-body buffer lifecycle changes out of this fix. I am preparing the focused fix and regression coverage. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
