users@jersey.java.net

Question on the Encoding of Query Parameters

From: Micha Werle <mwerle_at_gmail.com>
Date: Thu, 3 Dec 2009 10:03:05 +0000

Hi,

Sending a query using Jersey uses an internal URIBuilder
implementation, which uses an internal URIComponent's "contextual"
encoding mode for query parameters. This contextual mode treats any
data which looks like percent-encoded characters as percent-encoded
characters.

For example, adding a query parameter:
param: "dummy" value: "Amount is %30 of the total."

would get encoded and sent as:
dummy=Amount+is+%30+of+the+total.

On the server, this is then turned into:
param: "dummy" value: "Amount is 0 of the total."


In the current implementation, applications using the Jersey API have
no (easy) way to send data which just happens to look like
percent-encoded characters. Of course, knowing this makes it possible
to avoid this situation, but it does put the onus on the application
to ensure anything sent is sanitised first. Normally any transport
layer is responsible for transporting any data entrusted to it
verbatim to the destination.

So the question is: is the current method of encoding query parameters
in Jersey by design, or should this be treated as a bug/improvement
suggestion?

Many thanks,
 - Michael.

-- 
"The Glass is neither half-empty nor half-full; it is twice as big as
it needs to be!"