Bug in JakarteEE JEEContext::FullRequestURL

[yasper katgert]

Hello,

I've got an error where queryparameters are appended onto the requestURL StringBuffer every time the getFullRequestURL method is called. Could this please be fixed.

Thanks in advance!

Kind regards,

Yasper Katgert

[Jérôme LELEU]

Hi,

Can you elaborate on this error? pac4j version...

Can you provide a unit test demonstrating the issue?

Thanks.

Best regards,

Jérôme

--
You received this message because you are subscribed to the Google Groups "Pac4j development mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pac4j-dev+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/pac4j-dev/2eb12abc-221f-482f-984b-00ce9a142877n%40googlegroups.com.

[yasper katgert]

Yes,

Noticed in version 6.0.6, also in happens in version 6.1.1.

This test fails because the getFullRequestURL appends the queryString to the requestURL StringBuffer.

@Test
public void testGetFullRequestURL() {
    when(request.getRequestURL()).thenReturn(new StringBuffer("https://pac4j.org"));
    when(request.getQueryString()).thenReturn("name=value&name2=value2");
    WebContext context = new JEEContext(request, response);
    context.getFullRequestURL();
    assertEquals("https://pac4j.org", request.getRequestURL().toString()); 

}

Kind regards,

Yasper

Op wo 19 feb 2025 om 07:02 schreef Jérôme LELEU <lel...@gmail.com>:

[Jérôme LELEU]

Hi,

This is the contract of the getFullRequestURL method, this is by design, it is not a bug.

Thanks.

Best regards,

Jérôme

[yasper katgert]

Hello,

I understand that this getFullRequestURL-method should return the full url including the query parameters, but it shouldn't alter the original request url in my opinion. 

Underneath an example of what happens on multiple calls.

@Test
public void testGetFullRequestURL() {
    when(request.getRequestURL()).thenReturn(new StringBuffer("https://pac4j.org"));
    when(request.getQueryString()).thenReturn("name=value&name2=value2");
    WebContext context = new JEEContext(request, response);

    //request.getRequestURL().toString() equals "https://pac4j.org"
    context.getFullRequestURL(); //request.getRequestURL().toString() equals "https://pac4j.org?name=value&name2=value2"    

    context.getFullRequestURL(); //request.getRequestURL().toString() equals "https://pac4j.org?name=value&name2=value2?name=value&name2=value2"

    assertEquals("https://pac4j.org", request.getRequestURL().toString()); 

}

Kind regards,

Yasper

Op do 20 feb 2025 om 09:12 schreef Jérôme LELEU <lel...@gmail.com>:

[Jérôme LELEU]

Hi,

For sure, it should not alter the original request URL.

I'm really surprised by this issue: can you elaborate on your environment? pac4j implementation version? Use case?

Thanks.

Best regards,

Jérôme

[yasper katgert]

Hello,

I'm using OpenJDK Temurin v21
used pac4j version 6.1.1

Use case: For a REST-server having some information in the query parameters.
The way the requestURL and the queryString are combined should be changed so it will not alter the original requestURL StringBuffer.

@Override
public String getFullRequestURL() {
    val requestURL = request.getRequestURL();
    val queryString = request.getQueryString();
    if (queryString == null) {
        return requestURL.toString();
    }
    return requestURL.append('?').append(queryString).toString();
}

@Override
public String getFullRequestURL() {
    val requestURL = request.getRequestURL();
    val queryString = request.getQueryString();
    if (queryString == null) {
        return requestURL.toString();
    }
    return requestURL.toString() + '?' + queryString;
}


Let me know if you need more information.

Kind regards,
Yasper

Op do 20 feb 2025 om 11:43 schreef Jérôme LELEU <lel...@gmail.com>:

[Jérôme LELEU]

Hi,

I get it now. Excellent: good catch!

I should now be fixed in the latest snapshots thanks to: https://github.com/pac4j/pac4j/commit/cc3aa35a55f298d73fa8d1d119d3d5174eb122b1 and https://github.com/pac4j/pac4j/commit/020b10f962593cf5c6f167ada79fe45c869d3c01

Thanks.

Best regards,

Jérôme