[CXF-6015] Path parameters containing semicolon are truncated due to missing encoding

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.12, 3.0.1
• Fix Version/s: 2.7.13, 3.0.2, 3.1
• Component/s: JAX-RS

Environment

Apache Tomcat / 7.0.54
Eclipse Jetty / 9.2.2

• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Daniel H. Peger
• Created: 19/Sep/14 10:05
• Updated: 04/Aug/17 02:15
• Resolved: 24/Sep/14 15:56

Description

If a REST service uses path parameters, these parameters must not contain any semicolon as the parameter value gets truncated after the semicolon by many runtime environments. For that reason especially the semicolon should be encoded while building the client proxy.

I pinned this issue down to the usage of org.apache.cxf.jaxrs.utils.HttpUtils.pathEncode(String) during the creation of the request URI. Path parameters are encoded using a fixed list of characters (=@/:!$&\'(),;~) that are preserved in pathEncode(String). While this is fine/needed for encoding a complete path it leads to problems if used for encoding single elements of a path like path parameters.

Attached you'll find a minimal example project containing a simple REST service that returns the provided path parameters. If deployed on localhost:8080, a call to http://localhost:8080/cxf-test-service-0.1/cxf-test/Rüdiger/R&uuml%3Bdiger will result in anAttribute=R&uuml, anotherAttribute=Rüdiger to be returned.