From 6415f1204fa7bf7052971002ce5739b0d931d232 Mon Sep 17 00:00:00 2001
From: raccoonback <kosb15@naver.com>
Date: Mon, 18 Nov 2024 08:45:13 +0900
Subject: [PATCH] Prevent duplicate encoding issue in HTTP request parameter
 rewrite filter

Signed-off-by: raccoonback <kosb15@naver.com>
---
 ...eRequestParameterGatewayFilterFactory.java | 25 +++++++++++++++----
 ...estParameterGatewayFilterFactoryTests.java | 14 ++++++++++-
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactory.java b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactory.java
index ecffdf15..02bccdaf 100644
--- a/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactory.java
+++ b/spring-cloud-gateway-server/src/main/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactory.java
@@ -26,10 +26,14 @@ import org.springframework.cloud.gateway.filter.GatewayFilter;
 import org.springframework.cloud.gateway.filter.GatewayFilterChain;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.util.Assert;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.springframework.cloud.gateway.support.GatewayToStringStyler.filterToStringCreator;
+import static org.springframework.util.CollectionUtils.unmodifiableMultiValueMap;
 
 /**
  * @author Fredrich Ombico
@@ -59,14 +63,25 @@ public class RewriteRequestParameterGatewayFilterFactory
 				ServerHttpRequest req = exchange.getRequest();
 
 				UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUri(req.getURI());
-				if (req.getQueryParams().containsKey(config.getName())) {
-					uriComponentsBuilder.replaceQueryParam(config.getName(), config.getReplacement());
+
+				MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>(req.getQueryParams());
+				if (queryParams.containsKey(config.getName())) {
+					queryParams.remove(config.getName());
+					queryParams.add(config.getName(), config.getReplacement());
 				}
 
-				URI uri = uriComponentsBuilder.build().toUri();
-				ServerHttpRequest request = req.mutate().uri(uri).build();
+				try {
+					MultiValueMap<String, String> encodedQueryParams = UriUtils.encodeQueryParams(queryParams);
+					URI uri = uriComponentsBuilder.replaceQueryParams(unmodifiableMultiValueMap(encodedQueryParams))
+						.build(true)
+						.toUri();
 
-				return chain.filter(exchange.mutate().request(request).build());
+					ServerHttpRequest request = req.mutate().uri(uri).build();
+					return chain.filter(exchange.mutate().request(request).build());
+				}
+				catch (IllegalArgumentException ex) {
+					throw new IllegalStateException("Invalid URI query: \"" + queryParams + "\"");
+				}
 			}
 
 			@Override
diff --git a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactoryTests.java b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactoryTests.java
index 9df80c61..f7803861 100644
--- a/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactoryTests.java
+++ b/spring-cloud-gateway-server/src/test/java/org/springframework/cloud/gateway/filter/factory/RewriteRequestParameterGatewayFilterFactoryTests.java
@@ -71,11 +71,23 @@ class RewriteRequestParameterGatewayFilterFactoryTests {
 	}
 
 	@Test
-	void rewriteRequestParameterFilterWorksWithSpecialCharacters() {
+	void rewriteRequestParameterFilterWithSpecialCharactersInParameterValue() {
 		testRewriteRequestParameterFilter("campaign", "black friday~(1.A-B_C!)", "campaign=old&color=green",
 				Map.of("campaign", List.of("black friday~(1.A-B_C!)"), "color", List.of("green")));
 	}
 
+	@Test
+	void rewriteRequestParameterFilterWithSpecialCharactersInParameterName() {
+		testRewriteRequestParameterFilter("campaign[]", "red", "campaign%5B%5D=blue&color=green",
+				Map.of("campaign[]", List.of("red"), "color", List.of("green")));
+	}
+
+	@Test
+	void rewriteRequestParameterFilterKeepsOtherParamsEncoded() {
+		testRewriteRequestParameterFilter("color", "white", "campaign%5B%5D=blue&color=green",
+				Map.of("campaign[]", List.of("blue"), "color", List.of("white")));
+	}
+
 	private void testRewriteRequestParameterFilter(String name, String replacement, String query,
 			Map<String, List<String>> expectedQueryParams) {
 		GatewayFilter filter = new RewriteRequestParameterGatewayFilterFactory()