URL in a redirect is not escaped by RedirectView [SPR-7427]

[spring-projects-issues]

Christopher Kluwe opened SPR-7427 and commented

When a redirect URL(-Template) contains a UTF-8 encoded Identifier (e.g. /products/{productName}), it is sent back unencoded to the User Agent. Even using CharacterEncodingFilter with force-encoding enabled there is no Content-Type header in the response. So the User-Agent expects an ISO-8859-1 or US-ASCII encoded URL, urlencodes and requests it. Expecting a UTF8 encoded URL (through CharacterEncodingFilter), Spring decodes this path segment with a wrong encoding.

There are two possible solutions:

1. I need to determine the character encoding of the response and call UriUtils.encodePathSegment for every critical path segment
2. RedirectView calls UriUtils.encodePath itself

I've spent some thought on this and think that the second option is the way to go. The spring:url tag encodes the path parameters according to the response's encoding. To be consistent in this manner, RedirectView should do the same.

The appended simple change in RedirectView works fine for me, though I haven't run any Unit-Tests against it.

---

Affects: 3.0.3

Attachments:

• RedirectView.java.patch (624 bytes)

Issue Links:

• Problem with URL encoding in org.springframework.web.servlet.view.RedirectView.RedirectView(String url) [SPR-7490] #12148 Problem with URL encoding in org.springframework.web.servlet.view.RedirectView.RedirectView(String url)
• Regression in redirect URL encoding [SPR-7471] #12129 Regression in redirect URL encoding

Referenced from: commits 6e303d2

[spring-projects-issues]

Arjen Poutsma commented

This should be fixed now.

[spring-projects-issues]

Richard Larson commented

This seems to cause a regression by incorrectly encoding special characters as part of the parameters of the url, I have posted a bug report: https://jira.springframework.org/browse/SPR-7471

[spring-projects-issues]

Anders Hessellund Jensen commented

The URI passed to RedirectView should already encoded. It has to be, since the URI is passed as a plain String, and the URL parameters may contain characters such as ? and =. Therefore, this fix introduces a serious bug, as all request parameters will be encoded twice.

Furthermore, it is NOT possible to not encode the parameters beforehand. For example, the parameter value may itself be an URL, such as http://test.org?param=value. If I construct an URL using this parameter value, it would look something like http://example.org?query=http://test.org?param=value . RedirectView has no means encoding this URL correctly. Therefore, the only reasonable possibility is to pass the encoded url: http://example.org?query=http%3A%2F%2Ftest.org%3Fparam%3Dvalue to the RedirectView constructor.

[spring-projects-issues]

Arjen Poutsma commented

Reopened to take another look at this for 3.0.5

[spring-projects-issues]

Arjen Poutsma commented

I've reverted all the changes made for this issue, since they simply gave other people to much trouble (and broke their apps).

Simply put: RedirectView is now the way it was in 3.0.3 and requires encoded url to be passed on.