UriComponentsBuilder does not encode "$" properly [SPR-17168]

[spring-projects-issues]

Andras Tornai opened SPR-17168 and commented

 

@Test
public void encodeAndExpandDollarSignParameter() {
   UriComponents uri = UriComponentsBuilder
         .fromPath("/whatever").queryParam("q", "{value}").encode().build()
         .expand("JavaClass$1.class");

   assertEquals("/whatever?q=JavaClass%241.class", uri.toString());
}

Expected :/whatever?q=JavaClass%241.class
Actual :/whatever?q=JavaClass%5C%241.class

Thus on server side the JavaClass$1.class value becomes JavaClass$1.class

I made some investigation and this extra \ is there because of this statement: d81ec55#diff-07a4953c743ebcffceaf745f59544ac7R266%C2%A0- maybe it helps

Do I use UriComponentsBuilder incorrectly?

---

Affects: 5.0.8

Referenced from: commits 99f0129, f23496a

[spring-projects-issues]

Rossen Stoyanchev commented

Indeed it looks like we overlooked the effect of quoteReplacement as part of the changes for stricter encoding in #21577. As a workaround you can encode the URI variable values externally via UriUtils#encodeUriVariables:

Map<String, String> vars = Collections.singletonMap("value", "JavaClass$1.class");
Map<String, String> encodedVars = UriUtils.encodeUriVariables(vars);

UriComponents uri = UriComponentsBuilder
		.fromPath("/whatever").queryParam("q", "{value}").build()
		.expand(encodedVars);

assertEquals("/whatever?q=JavaClass%241.class", uri.toString());