Merge pull request #133 from SafeExamBrowser/SEBSP-143

Sebsp 143
SafeExamBrowser · Jun 21, 2024 · a72a88e · a72a88e
2 parents 4596993 + a8bcaa5
commit a72a88e
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 25 deletions.
diff --git a/src/main/java/ch/ethz/seb/sebserver/gbl/util/Utils.java b/src/main/java/ch/ethz/seb/sebserver/gbl/util/Utils.java
@@ -648,27 +648,24 @@ public static String toAppFormUrlEncodedBody(final MultiValueMap<String, String>
             return StringUtils.EMPTY;
         }
 
-        return attributes
-                .entrySet()
-                .stream()
-                .reduce(
-                        new StringBuilder(),
-                        (sb, entry) -> {
-                            final String name = entry.getKey();
-                            final List<String> values = entry.getValue();
-                            if (values == null) {
-                                return sb;
-                            }
-                            if (!sb.isEmpty()) {
-                                sb.append(Constants.AMPERSAND);
-                            }
-                            if (values.size() == 1) {
-                                return sb.append(name).append(Constants.EQUALITY_SIGN).append(values.get(0));
-                            }
-                            return sb.append(toAppFormUrlEncodedBody(name, values));
-                        },
-                        StringBuilder::append)
-                .toString();
+        return reduceFormUrlAttributes(attributes);
+    }
+
+    public static String toAppFormUrlEncodedBodyForSPService(final MultiValueMap<String, String> attributes) {
+        if (attributes == null) {
+            return StringUtils.EMPTY;
+        }
+
+        for (String key : attributes.keySet()) {
+            List<String> values = attributes.get(key);
+            if (values != null) {
+                for (int i = 0; i < values.size(); i++) {
+                    values.set(i, encodeFormURL_UTF_8(values.get(i)));
+                }
+            }
+        }
+
+        return reduceFormUrlAttributes(attributes);
     }
 
     public static String toAppFormUrlEncodedBody(@NotNull final String name, final Collection<String> array) {
@@ -925,4 +922,28 @@ public static Set<Long> getIdsFromString(final String idsString) {
                 .filter(Objects::nonNull)
                 .collect(Collectors.toSet());
     }
+
+    private static String reduceFormUrlAttributes(final MultiValueMap<String, String> attributes){
+        return attributes
+                .entrySet()
+                .stream()
+                .reduce(
+                        new StringBuilder(),
+                        (sb, entry) -> {
+                            final String name = entry.getKey();
+                            final List<String> values = entry.getValue();
+                            if (values == null) {
+                                return sb;
+                            }
+                            if (!sb.isEmpty()) {
+                                sb.append(Constants.AMPERSAND);
+                            }
+                            if (values.size() == 1) {
+                                return sb.append(name).append(Constants.EQUALITY_SIGN).append(values.get(0));
+                            }
+                            return sb.append(toAppFormUrlEncodedBody(name, values));
+                        },
+                        StringBuilder::append)
+                .toString();
+    }
 }
diff --git a/...sebserver/webservice/servicelayer/session/impl/proctoring/ScreenProctoringAPIBinding.java b/...sebserver/webservice/servicelayer/session/impl/proctoring/ScreenProctoringAPIBinding.java
@@ -695,7 +695,7 @@ String createSEBSession(
         params.add(SPS_API.SESSION.ATTR_CLIENT_MACHINE_NAME, clientConnection.getClientMachineName());
         params.add(SPS_API.SESSION.ATTR_CLIENT_OS_NAME, clientConnection.getClientOsName());
         params.add(SPS_API.SESSION.ATTR_CLIENT_VERSION, clientConnection.getClientVersion());
-        final String paramsFormEncoded = Utils.toAppFormUrlEncodedBody(params);
+        final String paramsFormEncoded = Utils.toAppFormUrlEncodedBodyForSPService(params);
 
         final ResponseEntity<String> exchange = apiTemplate.exchange(uri, paramsFormEncoded);
         if (exchange.getStatusCode() != HttpStatus.OK) {
@@ -910,7 +910,7 @@ private ScreenProctoringGroup createGroupOnSPS(
         params.add(SPS_API.GROUP.ATTR_NAME, name);
         params.add(SPS_API.GROUP.ATTR_DESCRIPTION, description);
         params.add(SPS_API.GROUP.ATTR_EXAM_ID, spsExamUUID);
-        final String paramsFormEncoded = Utils.toAppFormUrlEncodedBody(params);
+        final String paramsFormEncoded = Utils.toAppFormUrlEncodedBodyForSPService(params);
 
         final ResponseEntity<String> exchange = apiTemplate.exchange(uri, paramsFormEncoded);
         if (exchange.getStatusCode() != HttpStatus.OK) {
@@ -945,7 +945,7 @@ private void createExam(
 
             final String uuid = createExamUUID(exam);
             final MultiValueMap<String, String> params = createExamCreationParams(exam, uuid, userIds);
-            final String paramsFormEncoded = Utils.toAppFormUrlEncodedBody(params);
+            final String paramsFormEncoded = Utils.toAppFormUrlEncodedBodyForSPService(params);
 
             final ResponseEntity<String> exchange = apiTemplate.exchange(uri, paramsFormEncoded);
             if (exchange.getStatusCode() != HttpStatus.OK) {
@@ -1060,7 +1060,7 @@ private void createSEBAccess(
             final MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
             params.add(SPS_API.SEB_ACCESS.ATTR_NAME, name);
             params.add(SPS_API.SEB_ACCESS.ATTR_DESCRIPTION, description);
-            final String paramsFormEncoded = Utils.toAppFormUrlEncodedBody(params);
+            final String paramsFormEncoded = Utils.toAppFormUrlEncodedBodyForSPService(params);
 
             final ResponseEntity<String> exchange = apiTemplate.exchange(uri, paramsFormEncoded);
             if (exchange.getStatusCode() != HttpStatus.OK) {