fix: Do not decode + as space (#12432) (#12465)

Fix issue with URLDecoder handling of '+' character. Fixes #12354 Co-authored-by: caalador <[email protected]>
vaadin · Nov 29, 2021 · 8f0445c · 8f0445c
1 parent 24617c5
commit 8f0445c
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/flow-server/src/main/java/com/vaadin/flow/router/QueryParameters.java b/flow-server/src/main/java/com/vaadin/flow/router/QueryParameters.java
@@ -130,7 +130,7 @@ private static List<String> makeQueryParamList(String paramAndValue) {
             return Collections.singletonList(paramAndValue);
         }
         String param = paramAndValue.substring(0, index);
-        String value = paramAndValue.substring(index + 1);
+        String value = paramAndValue.substring(index + 1).replace("+", "%2B");
         try {
             value = URLDecoder.decode(value, "utf-8");
         } catch (UnsupportedEncodingException e) {

diff --git a/flow-server/src/test/java/com/vaadin/flow/router/LocationTest.java b/flow-server/src/test/java/com/vaadin/flow/router/LocationTest.java
@@ -110,6 +110,18 @@ public void locationFromSegments() {
         assertEquals("one/two", location.getPath());
     }
 
+    @Test
+    public void queryValue_decodedCorrectly() {
+        Location location = new Location("home?value+part");
+        Assert.assertEquals("'+' should not be decoded to space", "value+part",
+                location.getQueryParameters().getQueryString());
+
+        location = new Location("home?someValue1%2BsomeValue2");
+        Assert.assertEquals("'+' should not be double decoded",
+                "someValue1+someValue2",
+                location.getQueryParameters().getQueryString());
+    }
+
     @Test
     public void subLocation() {
         Location location = new Location(Arrays.asList("one", "two", "three"));

diff --git a/flow-server/src/test/java/com/vaadin/flow/router/QueryParametersTest.java b/flow-server/src/test/java/com/vaadin/flow/router/QueryParametersTest.java
@@ -32,9 +32,9 @@
 
 public class QueryParametersTest {
 
-    private String simpleInputQueryString = "one=1&two=2&three=3&four&five=4%2F5%266%2B7";
+    private String simpleInputQueryString = "one=1&two=2&three=3&four&five=4%2F5%266%2B7&six=val+ue";
 
-    private String complexInputQueryString = "one=1&one=11&two=2&two=22&three=3&four&five=4%2F5%266%2B7";
+    private String complexInputQueryString = "one=1&one=11&two=2&two=22&three=3&four&five=4%2F5%266%2B7&six=val+ue";
 
     private Map<String, String> getSimpleInputParameters() {
         Map<String, String> inputParameters = new HashMap<>();
@@ -106,6 +106,7 @@ public void simpleParametersFromQueryString() {
         expectedFullParams.put("three", Collections.singletonList("3"));
         expectedFullParams.put("four", Collections.singletonList(""));
         expectedFullParams.put("five", Collections.singletonList("4/5&6+7"));
+        expectedFullParams.put("six", Collections.singletonList("val+ue"));
         assertEquals(expectedFullParams, simpleParams.getParameters());
     }
 
@@ -158,6 +159,7 @@ public void complexParametersFromQueryString() {
         expectedFullParams.put("three", Collections.singletonList("3"));
         expectedFullParams.put("four", Collections.singletonList(""));
         expectedFullParams.put("five", Collections.singletonList("4/5&6+7"));
+        expectedFullParams.put("six", Collections.singletonList("val+ue"));
         assertEquals(expectedFullParams, fullParams.getParameters());
     }