0

Under spingboot 2.x, I have a url http://localhost:8940/authorize/abc/getCode/{"client_id":"48e09e3-87b8395f7c5f","redirect_uri":"https://testvei.cn/vestomer/GjViQ?cardBag=1","state":"GWeiQ","scope":"phonginfo,openid","response_type":"code"}

And my controller method

  @RequestMapping("/abc/getCode/**")
public void abcAuthorizeGetCode() {
    Object path = request.getAttribute(HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE);
    Object pathVariable = request.getAttribute(HandlerMapping.PATH_WITHIN_HANDLER_MAPPING_ATTRIBUTE);
    String pathParamJson = pathMatcher.extractPathWithinPattern((String) path, (String) pathVariable);
    JSONObject params = JSON.parseObject(URLDecoder.decode(pathParamJson, "UTF-8"));
    String redirectUri = params.getString("redirect_uri");
}

when sending request by that url ,I got a 400 error,says "Invalid character found in the request target". By removing "?" (the new Url http://localhost:8940/authorize/abc/getCode/{"client_id":"48e09e3-87b8395f7c5f","redirect_uri":"https://testvei.cn/vestomer/GjViQcardBag=1","state":"GWeiQ","scope":"phonginfo,openid","response_type":"code"}) it gots normal again, I've got confused .

And another question,why browers will auto encode illeagl characters in the path however character after the "?" will not ?

For example

http:// localhost:8940/d/{

will encode to

http:// localhost:8940/d/%7B

however

http:// localhost:8940/d?param={

will cause 400 error

J John
  • 299
  • 1
  • 3
  • 15

1 Answers1

0

tThis is not a problem on the server side, the caller needs to encode the URL to http://localhost:8940/authorize/abc/getCode/%7B%22client_id%22%3A%2248e09e3-87b8395f7c5f%22%2C%22redirect_uri%22%3A%22https%3A%2F%2Ftestvei.cn%2Fvestomer%2FGjViQ%3FcardBag%3D1%22%2C%22state%22%3A%22GWeiQ%22%2C%22scope%22%3A%22phonginfo%2Copenid%22%2C%22response_type%22%3A%22code%22%7D

P.J.Meisch
  • 18,013
  • 6
  • 50
  • 66
  • Is there any solution without encoding url ? – J John Apr 05 '23 at 05:31
  • I doubt it. The URL you have contains illegal characters (see https://en.wikipedia.org/wiki/URL_encoding). And any framework handling with URLs that has a minimum handling of security will reject this. – P.J.Meisch Apr 05 '23 at 06:24
  • @JJohn The key issue is the json part in you path not in query. Since the json string in path, it must not contains illegal characters without encoded. This issue might be useful: https://stackoverflow.com/questions/4669692/valid-characters-for-directory-part-of-a-url-for-short-links . – Horsing Apr 05 '23 at 07:54