<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=fransflippo" rel="nofollow">Frans Flippo</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-9098?redirect=false" rel="nofollow">SPR-9098</a></strong> and commented</p>
<p dir="auto">Say I have a Controller with the following request mapping:</p>
<p dir="auto"><code class="notranslate">@RequestMapping</code>(value = "/{group}/{identifier}", method = RequestMethod.GET)</p>
<p dir="auto"><strong>Current behavior:</strong></p>
<p dir="auto">If one of the PathVariable components (e.g. "identifier" in the above example) contains a URL encoded slash (%2F), the handler is NOT invoked for that request, e.g.<br>
<a href="http://myhost/myservlet/group/a%2Fb" rel="nofollow">http://myhost/myservlet/group/a%2Fb</a></p>
<p dir="auto"><strong>Expected behavior:</strong></p>
<p dir="auto">If one of the PathVariable comonents (e.g. "identifier" in the above example) contains a URL encoded slash (%2F), the handler is invoked for that request and the URL decoded value is assigned to the path variable, e.g.<br>
<a href="http://myhost/myservlet/group/a%2Fb" rel="nofollow">http://myhost/myservlet/group/a%2Fb</a></p>
<p dir="auto">calls the handler method above with group="group" and identifier="a/b"</p>
<p dir="auto">This is supported by the RFC which assigns special meaning to the slash character and states a slash and a URL encoded slash are NOT the same character:</p>
<p dir="auto">RFC 3986 says (section 2.2) :<br>
The purpose of reserved characters is to provide a set of delimiting<br>
characters that are distinguishable from other data within a URI.<br>
URIs that differ in the replacement of a reserved character with its<br>
corresponding percent-encoded octet are not equivalent.  Percent-<br>
encoding a reserved character, or decoding a percent-encoded octet<br>
that corresponds to a reserved character, will change how the URI is<br>
interpreted by most applications.  Thus, characters in the reserved<br>
set are protected from normalization and are therefore safe to be<br>
used by scheme-specific and producer-specific algorithms for<br>
delimiting data subcomponents within a URI.</p>
<p dir="auto">The actual URL decoding happens in UrlPathHelper.getLookupPathForRequest which eventually calls getRequestUri which calls decodeAndCleanUriString. This is basically too early. First the handler should be chosen and the PathVariables assigned. Then URL decoding should happen on each of the path variables' values.</p>
<p dir="auto">If desired I can write a unit test or include a sample Controller to reproduce the above.</p>
<p dir="auto"><strong>Note:</strong> Tomcat MUST be started with the -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true option or the request will never even land at the Spring DispatcherServlet.</p>
<hr>
<p dir="auto"><strong>Affects:</strong> 3.1 GA</p>
<p dir="auto"><strong>Issue Links:</strong></p>
<ul dir="auto">
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="398103609" data-permission-text="Title is private" data-url="https://github.com/spring-projects/spring-framework/issues/11616" data-hovercard-type="issue" data-hovercard-url="/spring-projects/spring-framework/issues/11616/hovercard" href="https://github.com/spring-projects/spring-framework/issues/11616">#11616</a> Decode URI template variables if the AbstractHandlerMethodMapping.setUrlDecode() property is set to false (<em><strong>"is duplicated by"</strong></em>)</li>
</ul>
<p dir="auto"><strong>Referenced from:</strong> commits <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/spring-projects/spring-framework/commit/57307a0b2e5bce8f70d5deddf8df11d034dc8c5a/hovercard" href="https://github.com/spring-projects/spring-framework/commit/57307a0b2e5bce8f70d5deddf8df11d034dc8c5a"><tt>57307a0</tt></a></p>
<p dir="auto">1 votes, 3 watchers</p>
<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=romezz" rel="nofollow">Roman Borisov</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-4250?redirect=false" rel="nofollow">SPR-4250</a></strong> and commented</p>
<p dir="auto">If I create abstract beans with similar IDs in different context files, the framework  uses abstract bean from last loaded file.<br>
I thought, the framework will throw the exception at startup.</p>
<p dir="auto">Example:</p>
<p dir="auto">file beans1.xml</p>
<p dir="auto">&lt;beans&gt;<br>
&lt;bean id="abstractNamedBean" abstract="true"&gt;<br>
&lt;property name="name" value="Pol"/&gt;<br>
&lt;/bean&gt;<br>
&lt;/beans&gt;</p>
<p dir="auto">file beans2.xml</p>
<p dir="auto">&lt;beans&gt;<br>
&lt;bean id="abstractNamedBean" abstract="true"&gt;<br>
&lt;property name="name" value="Scott"/&gt;<br>
&lt;/bean&gt;<br>
&lt;/beans&gt;</p>
<p dir="auto">file beans3.xml</p>
<p dir="auto">&lt;beans&gt;<br>
&lt;import resource="beans1.xml"/&gt;<br>
&lt;import resource="beans2.xml"/&gt;<br>
&lt;!---- this bean wiil be the child of "abstractNamedBean" from beans2.xml<br>
and no error would be reported --&gt;<br>
&lt;bean id="concreteNamedBean" class="Class1" parent="abstractNamedBean"&gt;<br>
&lt;/bean&gt;<br>
&lt;/beans&gt;</p>
<hr>
<p dir="auto"><strong>Affects:</strong> 2.0.7</p>