[OLINGO-1610] Use of odata-accept-forms-encoding param is not thread safe

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: (Java) V4 4.10.0
• Component/s: odata4-server
• Assignee: Unassigned
• Reporter: Graham Eveleigh
• Created: 24/Nov/23 18:34
• Updated: 24/Nov/23 18:34

Description

OLINGO-752 introduced a URL parameter odata-accept-forms-encoding to allow clients to select if a + character in URL the query strings should be treated as a space or a literal plus.

The implementation uses a static variable to store whether the current request is using forms encoding or not. When multiple requests happen concurrently, some using forms encoding and some not, it will be non-deterministic how each request will be treated.

The fix is here: https://github.com/apache/olingo-odata4/commit/38f77daa5c555af2012449e1f090a0395bd7a883#diff-89efeb911e74ea7196a37764707a489da87115ac5c0e535746370a6869f5cd94

See how Parser.parseUri makes to calls to static methods on UriDecoder, namely splitAndDecodeOptions first and later isFormEncoding. The call to splitAndDecodeOptions checks if the request is using forms encoding and saves the result in the static field UriDecoder.formEncoding. The second call to isFormEncoding returns the value of UriDecoder.formEncoding. If a second call to splitAndDecodeOptions is made before isFormEncoding is called, the wrong result may be returned.