Redirect views mangle extended UTF-8 Characters [SPR-9072]

[spring-projects-issues]

Kenneth DeLong opened SPR-9072 and commented

Our application has URLs that are in many languages, including Arabic, Chinese, and Russian. The URLs may contain these extended characters, e.g. /thread/13741/%D8%A8%D8%AF%D9%87%D8%A7-%D8%B5%D8%A8%D8%B1.

In our controller, we return a view name of
return "redirect:" + uri;
Where the variable "uri" is a java.lang.String of the form "/thread/13741/<arabic characters>".

The view resolution framework does not handle this well, it totally mangles the Arabic characters, turning them into something like /thread/13741/%28/G%27-5%281.

RedirectView (and friends) should properly percent-encode the string before issuing the redirect.

---

Affects: 3.1 GA

[spring-projects-issues]

Rossen Stoyanchev commented

The view resolution framework does not handle this well, it totally mangles the Arabic characters, turning them into something like /thread/13741/%28/G%27-5%281.

RedirectView only encodes appended query parameters and in 3.1 we also encode any expanded URI variables (relevant discussion under #13288). The remaining parts of the redirect URL are left intact so I'm not sure I understand what you mean about mangling non-ASCII characters. Could you elaborate?

Note that in 3.1 we also added an option for building and encoding the URL. See this JIRA comment and the reference documentation is also updated. If you build and encode the entire redirect URL and return it no further encoding will be done.

[spring-projects-issues]

Kenneth DeLong commented

I have a controller method like this:
@RequestMapping("/admin/test")
public String testMethod()
{
String url = "/a2800016/الرضاعة";
return "redirect:" + url;
}

When I hit the URL /admin/test, I get redirected to
/a2800016/'D16'9)

This is not correct, the arabic characters should have been Percent Encoded.
I think the correct string is:
/a2800016/%D8%A7%D9%84%D8%B1%D8%B6%D8%A7%D8%B9%D8%A9

[spring-projects-issues]

Rossen Stoyanchev commented

As described above RedirectView doesn't encode the literal parts of the URL and that's not new behavior. In 3.1 you can embed URI variables, which do get encoded. So you can do something like this:

@RequestMapping("/admin/test")
public String testMethod(RedirectAttributes attributes) { 
    attributes.addAttribute("var", "الرضاعة"); 
    return "redirect:/a2800016/{var}";
} 

Note that the request encoding has to be UTF-8 or otherwise the default used is ISO-8859-1. There is also a setEncodingScheme property on RedirectView.

There other alternative is to encode the URL within the controller method with UriTemplate or UriComponentsBuilder, which is supported as a method argument as well but the above should do.

[spring-projects-issues]

Rossen Stoyanchev commented

As mentioned in my last comment, the literal parts of the redirect URL were never encoded automatically. Certainly not an option to change the default now but the option to use URI templates in 3.1, where URI variables are encoded provides some leverage. You can also consider adding a UriComponentsBuilder argument and using it to prepare the redirect URL for full control over encoding.