Fixes #255 - Incorrect double-unescaping of request parameters breaks restricted mode check on view name presence

danielfernandez · danielfernandez · commit 8add4fd8b884 · 2021-11-21T23:32:52.000+01:00
diff --git a/thymeleaf-spring3/src/main/java/org/thymeleaf/spring3/util/SpringRequestUtils.java b/thymeleaf-spring3/src/main/java/org/thymeleaf/spring3/util/SpringRequestUtils.java
@@ -52,7 +52,7 @@ public static void checkViewNameNotInRequest(final String viewName, final HttpSe
             while (!found && paramNames.hasMoreElements()) {
                 paramValues = request.getParameterValues(paramNames.nextElement());
                 for (int i = 0; !found && i < paramValues.length; i++) {
-                    paramValue = StringUtils.pack(UriEscape.unescapeUriQueryParam(paramValues[i]));
+                    paramValue = StringUtils.pack(paramValues[i]);
                     if (paramValue.contains(vn)) {
                         found = true;
                     }
diff --git a/thymeleaf-spring4/src/main/java/org/thymeleaf/spring4/util/SpringRequestUtils.java b/thymeleaf-spring4/src/main/java/org/thymeleaf/spring4/util/SpringRequestUtils.java
@@ -52,7 +52,7 @@ public static void checkViewNameNotInRequest(final String viewName, final HttpSe
             while (!found && paramNames.hasMoreElements()) {
                 paramValues = request.getParameterValues(paramNames.nextElement());
                 for (int i = 0; !found && i < paramValues.length; i++) {
-                    paramValue = StringUtils.pack(UriEscape.unescapeUriQueryParam(paramValues[i]));
+                    paramValue = StringUtils.pack(paramValues[i]);
                     if (paramValue.contains(vn)) {
                         found = true;
                     }
diff --git a/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/util/SpringRequestUtils.java b/thymeleaf-spring5/src/main/java/org/thymeleaf/spring5/util/SpringRequestUtils.java
@@ -52,7 +52,7 @@ public static void checkViewNameNotInRequest(final String viewName, final HttpSe
             while (!found && paramNames.hasMoreElements()) {
                 paramValues = request.getParameterValues(paramNames.nextElement());
                 for (int i = 0; !found && i < paramValues.length; i++) {
-                    paramValue = StringUtils.pack(UriEscape.unescapeUriQueryParam(paramValues[i]));
+                    paramValue = StringUtils.pack(paramValues[i]);
                     if (paramValue.contains(vn)) {
                         found = true;
                     }

Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ public static void checkViewNameNotInRequest(final String viewName, final HttpSe`
`52`	`52`	`while (!found && paramNames.hasMoreElements()) {`
`53`	`53`	`paramValues = request.getParameterValues(paramNames.nextElement());`
`54`	`54`	`for (int i = 0; !found && i < paramValues.length; i++) {`
`55`		`- paramValue = StringUtils.pack(UriEscape.unescapeUriQueryParam(paramValues[i]));`
	`55`	`+ paramValue = StringUtils.pack(paramValues[i]);`
`56`	`56`	`if (paramValue.contains(vn)) {`
`57`	`57`	`found = true;`
`58`	`58`	`}`