UriComponentsBuilder.query(String) does not always match properly the query [SPR-9474]

[spring-projects-issues]

Lachezar Kozhuharov opened SPR-9474 and commented

I would expect the matching pattern not to partially enforce the query structure. Expected behavior is to fully enforce it or not to enforce it at all. This would be useful when for example building a RESTful service client. A query like "a=b&filter=c==d" is not properly processed and results in URI change.

---

Affects: 3.1 RC2

Issue Links:

• Erroneous "0" returned where empty string expected in call through the RestTemplate [SPR-9832] #14465 Erroneous "0" returned where empty string expected in call through the RestTemplate ("duplicates")

Referenced from: commits 2965df6

[spring-projects-issues]

Rossen Stoyanchev commented

I'm not sure what you mean by "matching pattern". The UriComponentsBuilder.query(String) method appends a string, it doesn't match anything.

If you provide a query string such as "a=b&filter=c==d", it won't be properly parsed since it contains reserved characters. Either use the queryParam(String, Object...) method or a URI variable, i.e. query("a=b&filter={value}").buildAndExpand("c==d").

[spring-projects-issues]

Lachezar Kozhuharov commented

I was referring to the pattern used internally to parse the query. IMHO changing the URI is not the expected behavior. Especially when you don't have control over it e.g. RestTemplate.

 
String uri = "https://example.com?a=b&filter=c==d";
UriComponents uriComponents = UriComponentsBuilder.fromUriString(uri).build();
uriComponents.toUriString().equals(uri); //evaluates to false

[spring-projects-issues]

Rossen Stoyanchev commented

I see now.

We could change the pattern to work for this example URI string but what if it was "https://example.com?a=b&filter=c=&=d"? In order to properly encode the URI, the UriComponents class needs to know the query parameters and that is impossible to tell when query parameters contain reserved characters. One way to let the UriComponentsBuilder parse the query without ambiguity, is to use a URI variable:

String uri = "https://example.com?a=b&filter={value}";
UriComponents uriComponents = UriComponentsBuilder.fromUriString(uri).buildAndExpand("c==d").encode();
uriComponents.toUriString().equals("https://example.com?a=b&filter=c%3D%3Dd");

Or if you want to use your URI just the way it is, use the RestTemplate methods that accept a java.net.URI.

URI uri = new URI("https://example.com?a=b&filter=c==d");
restTemplate.getForObject(uri, String.class);

[spring-projects-issues]

Lachezar Kozhuharov commented

My point was not about changing the pattern. I would expect RuntimeException if the URI could not be parsed correctly, not changing it and making a request to a different URI.

Correct me if I am wrong, but following http://tools.ietf.org/html/rfc3986#section-3.4 the definition of query doesn't include "reserved characters". I believe expected query format should at least be documented.

[spring-projects-issues]

Rossen Stoyanchev commented

'=' and '&' are reserved sub-delim characters. The query string can contain them but when used if used withing a query parameter name or value, they need to be encoded. I've added a warning to the Javadoc that the presence of special characters can prevent correct parsing.

[spring-projects-issues]

Rossen Stoyanchev commented

This issue should now be fixed. See comment under #14465.