[CONFIGURATION-415] ConfigurationUtils.fileFromURL mangles files with '+' (plus sign) in the name

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.7
• Assignee: Oliver Heger
• Reporter: Brian Stiles
• Created: 19/May/10 22:55
• Updated: 08/Sep/11 09:20
• Resolved: 29/May/10 14:25

Description

Attached is a sample program that demonstrates the problem. The following is the method in ConfigurationUtils in question:

public static File fileFromURL(URL url)
{
...
return new File(URLDecoder.decode(url.getPath()));
...
}

URLDecoder (poorly named) decodes data encoded in the application/x-www-form-urlencoded MIME format. This format is commonly used to encode HTML form data. It is not intended for encoding URLs, though the formats are similar.

The operative difference is that the MIME format allows the use of the plus sign ('+') to represent spaces, whereas URLs must have spaces hex encoded ('%20'). Files may have plus signs in the name, and therefore, decoding the plus sign as a space produces a different path.

See attached code demonstrating the problem.

Reference: http://www.w3.org/MarkUp/html-spec/html-spec_8.html#SEC8.2.1
and http://www.ietf.org/rfc/rfc1738.txt