- Severity: High
- Location:
shenyu-web/src/main/java/org/apache/shenyu/web/filter/CollapseSlashesFilter.java:36-38
Description:
The filter computes newPath = request.getURI().getRawPath().replaceAll("/{2,}", "/") (path-only string, no query/fragment), then calls request.getURI().resolve(newPath). Per java.net.URI resolution semantics, resolving a relative reference with only a path component replaces the query and fragment of the base URI with null. E.g. URI.create("http://h/a//b?q=1#f").resolve("/a/b") produces http://h/a/b — query and fragment silently lost.
Impact:
When collapseSlashes=true, any request with double-slashes in the path AND a query string loses all query parameters. Breaks pagination, search, API key passing, query-param-dependent routing.
Suggested fix:
Reconstruct the URI preserving query/fragment: UriComponentsBuilder.fromUri(request.getURI()).replacePath(newPath).build().toUri().
Confidence: High
- Related existing: PERF-03 covers regex recompilation perf in the same filter, not the query-loss functional bug.
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
shenyu-web/src/main/java/org/apache/shenyu/web/filter/CollapseSlashesFilter.java:36-38Description:
The filter computes
newPath = request.getURI().getRawPath().replaceAll("/{2,}", "/")(path-only string, no query/fragment), then callsrequest.getURI().resolve(newPath). Perjava.net.URIresolution semantics, resolving a relative reference with only a path component replaces the query and fragment of the base URI with null. E.g.URI.create("http://h/a//b?q=1#f").resolve("/a/b")produceshttp://h/a/b— query and fragment silently lost.Impact:
When
collapseSlashes=true, any request with double-slashes in the path AND a query string loses all query parameters. Breaks pagination, search, API key passing, query-param-dependent routing.Suggested fix:
Reconstruct the URI preserving query/fragment:
UriComponentsBuilder.fromUri(request.getURI()).replacePath(newPath).build().toUri().Confidence: High
Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/00-consolidated-critical-high.md.