search

sonatype / ossindex-public

Sonatype OSS Index - Public
Apache License 2.0
6 stars 9 forks source link

Incorrect URL encoded coordinates in REST response #9

Open missingdays opened 4 years ago

missingdays commented 4 years ago

Hi! I've noticed that requesting coordinates containing "+" symbol in version, e.g. pkg:maven/org.antlr/antlr4@4.+ results in incorrectly encoded coordinates in response - "coordinates": "pkg:maven/org.antlr/antlr4@4.%20. This breaks matching request and response by coordinates.

voronaam commented 4 years ago

According to the spec 1 "a purl is a URL" and conforms to the RFC.

As such, you would need to encode + as %2B - much like any time you would want to do that with an URL.

And "pkg:maven/org.antlr/antlr4@4.%2B" comes through properly, as far as I could tell.

missingdays commented 4 years ago

According to URL specification, + sign is not a special character and can be used without encoding it. See https://tools.ietf.org/html/rfc1738, specifically part 5, BNF for specific URL schemes.

The problem in question is that the + sign is that it's encoded as %20 which is an encoding for a ` sign (a space) and not for a+sign. This error probably comes from usingURLEncoder.encode`, which is not URL specification compliant, see https://bugs.openjdk.java.net/browse/JDK-8179507