Request mapping using @PathVariable doesn't work with URL-encoded values [SPR-7919]

[spring-projects-issues]

Lukas Hämmerle opened SPR-7919 and commented

I have defined the following request mapping:
@RequestMapping(value = "/services/{serviceKey}/vos", method = RequestMethod.GET)

There is a problem if the value of {serviceKey} contains a "/", for example if {serviceKey}=http://example.com/foo
This makes sense of course since the requestmapping cannot easily know that the / is part of a PathVariable.

However, I would have assumed that if the URL is URL-encoded as "http%3A%2F%2Fexample.com%2Ffoo" this should not be a problem. But apparently this values for some reason cannot mapped properly because it reports:

"org.springframework.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/core/services/http://example.com/foo/vos]"

If the already URL-encoded values is URL-encoded again to "http%253A%252F%252Fexample.com%252Ffoo", the mapping works:

"org.springframework.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/core/services/http%3A%2F%2Fexample.com%2Ffoo/vos]"

So, my question is whether there is a way how to make Spring accept the URL encoded value "http%3A%2F%2Fexample.com%2Ffoo" as PathVariable or whether this is a bug.

I tested this on Tomcat 6 and Jetty 7.

---

Affects: 3.0.3

Issue Links:

• URLs containing %2F (forward slash) are not mapped correctly to @RequestMapping methods [SPR-11101] #15727 URLs containing %2F (forward slash) are not mapped correctly to @RequestMapping methods

1 votes, 3 watchers

[spring-projects-issues]

John Boardman commented

This is a particularly pesky bug to figure out because the problem can be intermittent. I was passing a URL-encoded UUID from UUID.randomUUID(). Sometimes the UUID would include a / and then fail to map and the problem was far from obvious.

[spring-projects-issues]

Rossen Stoyanchev commented

All HandlerMapping implementations have a setDecodeUrl(boolean) setter that allows you to turn off URL decoding.

[spring-projects-issues]

Rossen Stoyanchev commented

Re-opening after more feedback in #15727. Setting decodeUrl=false is not sufficient where the DispatcherServlet is mapped to "/".

[spring-projects-issues]

Rossen Stoyanchev commented

Marking as duplicate of #15727 even though technically this issue was opened earlier. In any case the fix is under #15727 targeting version 4.0.2.