Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
8.0.8
-
None
-
None
Description
Where form parameters are retrieved via HttpServletRequest.getParameter methods (https://github.com/apache/cxf/blob/master/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/FormUtils.java#L176-L180), the key and value are already URL decoded.
They are then subsequently decoded again: https://github.com/apache/cxf/blob/master/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/utils/JAXRSUtils.java#L1172-L1178
The effect here is that an endpoint like this:
@POST @Path("/api") @Consumes(MediaType.APPLICATION_FORM_URLENCODED) @Produces(MediaType.TEXT_PLAIN) public Response myWebService(@Context HttpServletRequest request, @Context HttpServletResponse res, @FormParam("p1") String p1) { LOGGER.info("Value received: " + p1); return Response.ok(p1).build(); }
if called with a payload of
p1=hello%2bworld
would receive "hello world" and not "hello+world".
A test for this is here: https://github.com/apache/tomee/commit/fdf4ef88b5943cc7556ed1984c2982801b6c2841
Attachments
Issue Links
- links to