Skip to content

Query and form parameters whose value contains = are truncated or rejected as malformed - #1074

Open
chuuminggg wants to merge 2 commits into
spring-projects:4.0.xfrom
chuuminggg:n2-parameter-value-containing-equals
Open

chuuminggg wants to merge 2 commits into
spring-projects:4.0.xfrom
chuuminggg:n2-parameter-value-containing-equals

Conversation

@chuuminggg

Copy link
Copy Markdown
Contributor

Fixes gh-1073

This updates QueryParameters, FormParameters, and MockMvcRequestConverter to only split a parameter on its first =, in the same way as was done for cookies in #1040. Previously, a value containing = was either truncated (cursor=YWJj== became YWJj) or rejected as malformed (filter=name==bob). With MockMvc, the latter caused a ConversionException when the request was built from a URI, and the former caused the query parameter to be duplicated in the form URL encoded request body.

The name of a parameter with no value is now also decoded, which makes it consistent with a parameter that has a value. As every input can now be parsed, the IllegalArgumentException for a malformed parameter is no longer thrown.

There were no tests for QueryParameters and FormParameters, so I've added them, covering the existing behavior as well as the new cases.

@wilkinsona wilkinsona added type: bug A bug and removed status: waiting-for-triage Untriaged issue labels Oct 15, 2026
@wilkinsona wilkinsona added this to the 4.0.x milestone Oct 15, 2026
@wilkinsona

Copy link
Copy Markdown
Member

Thanks, @chuuminggg. 3.0.x is no longer supported. Can you please update your PR to use 4.0.x as its base branch?

@chuuminggg
chuuminggg force-pushed the n2-parameter-value-containing-equals branch from 2b7fbb3 to 5c753cf Compare October 15, 2026 23:22
@chuuminggg
chuuminggg changed the base branch from 3.0.x to 4.0.x October 15, 2026 23:23
Previously, QueryParameters, FormParameters, and MockMvcRequestConverter
split a parameter on every = so a value containing = was either
truncated or rejected as malformed. Parameters are now only split on
their first =. The name of a parameter with no value is also now
decoded.

Fixes spring-projectsgh-1073

Signed-off-by: chuuminggg <rorrxr@naver.com>
@chuuminggg
chuuminggg force-pushed the n2-parameter-value-containing-equals branch from 5c753cf to 189a20b Compare October 16, 2026 00:46
@chuuminggg

Copy link
Copy Markdown
Contributor Author

I've rebased the PR onto 4.0.x and changed its base branch. The tests have also been updated to use JUnit 5 to match the 4.0.x conventions.

Signed-off-by: chuuminggg <rorrxr@naver.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants