[jdk11u-dev] Integrated: 8245245: WebSocket can lose the URL encoding of URI query parameters

[Michal Karm Babacek]

On Wed, 30 Nov 2022 01:52:47 GMT, Michal Karm Babacek <duke at openjdk.org> wrote:

> Proposes to backport [JDK-8245245](https://bugs.openjdk.org/browse/JDK-8245245).
> 
> The backport is clean as far as the actual `OpeningHandshake.java` goes. The test needed a little tweak so as to compile with `SimpleSSLContext` and also to handle the fact that the erroneous response does not bring a response body.
> 
> The test passes with the patch, fails without it.
> 
> 
> $ make clean run-test TEST="jtreg:test/jdk/java/net/httpclient/websocket/HandshakeUrlEncodingTest.java"
> ...
> ==============================
> Test summary
> ==============================
>    TEST                                              TOTAL  PASS  FAIL ERROR   
>    jtreg:test/jdk/java/net/httpclient/websocket/HandshakeUrlEncodingTest.java
>                                                          1     1     0     0   
> ==============================
> TEST SUCCESS
> 
> Stopping sjavac server
> Finished building targets 'clean run-test' in configuration 'linux-x86_64-normal-server-release'
> 
> In addition to that, I compiled and executed the original `WebSocketTest.java` reproducer found on  [JDK-8245245](https://bugs.openjdk.org/browse/JDK-8245245) JIRA.
> 
> 
> ## Unpatched Temurin-11.0.17+8  ❌ 
> 
> $ java WebSocketTest 
> Http Request
> http://localhost:8000/?raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> Server RequestURI: /?raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> WebSocket Request
> ws://localhost:8000/?&raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> Server RequestURI: /?&raw=abc+def/ghi=xyz&encoded=abc+def/ghi=xyz
> 
> 
> ## Patched jdk11u ✔ 
> 
> $ java WebSocketTest 
> Http Request
> http://localhost:8000/?raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> Server RequestURI: /?raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> WebSocket Request
> ws://localhost:8000/?&raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> Server RequestURI: /?&raw=abc+def/ghi=xyz&encoded=abc%2Bdef%2Fghi%3Dxyz
> 
> The patched version correctly leaves the latter part of the query param encoded.

This pull request has now been integrated.

Changeset: ce106888
Author:    Karm Michal Babacek <karm at redhat.com>
Committer: Paul Hohensee <phh at openjdk.org>
URL:       https://git.openjdk.org/jdk11u-dev/commit/ce10688829436a4172ce303283ead277b7e4c8db
Stats:     228 lines in 2 files changed: 220 ins; 6 del; 2 mod

8245245: WebSocket can lose the URL encoding of URI query parameters
8298588: WebSockets: HandshakeUrlEncodingTest unnecessarily depends on a response body

The fix updates jdk.internal.net.http.websocket.OpeningHandshake to avoid double encoding and decoding of URL

Reviewed-by: phh, sgehwolf
Backport-of: c07ce7eec71aefbd3cb624e03ca53f5148d01f19

-------------

PR: https://git.openjdk.org/jdk11u-dev/pull/1558