HierarchicalUriComponents.encodeUriComponent() method can not encode Pchar [SPR-17621]

[spring-projects-issues]

sunbufu opened SPR-17621 and commented

Hi guy,

I have a question about HierarchicalUriComponents.encodeUriComponent() method. I think it should encode all special char in url query param, Actually, It can not encode many special char. For example + - ! $ ... in url query param. and my email is [sunyoubufu@qq.com|mailto:sunyoubufu@qq.com] . 

---

Affects: 5.0.6

Reference URL: https://github.com/spring-projects/spring-framework/blob/5.0.x/spring-web/src/main/java/org/springframework/web/util/HierarchicalUriComponents.java

Attachments:

• 1.jpg (141.61 kB)
• 2.jpg (34.55 kB)
• 3.jpg (156.38 kB)

[spring-projects-issues]

Brian Clozel commented

Did you take a loot at the RFC that's referenced from the implementation here?

The RFC 3986 states that the following characters are allowed in a query string (see the appendix A in the ABNF):

query         = *( pchar / "/" / "?" )
pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
pct-encoded   = "%" HEXDIG HEXDIG
sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
                 / "*" / "+" / "," / ";" / "="

This means that sub-delimiters are allowed in query strings and do not need to be percent encoded (that includes +, $).

Now I understand that some legal characters might still have a special meaning. We've applied some changes to be more consistent with the encoding of URLs (see #21399), and I think you're ultimately after what was addressed in #21577 (see the dedicated section in the reference documentation).

Thanks!

[spring-projects-issues]

sunbufu commented

Got it. Thanks very much.