Repository navigation
fix(auth): URL-encode query parameter keys and values in HttpUtils - #582
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the HttpUtils.EncodeQueryParams method to properly escape query parameter keys and values using Uri.EscapeDataString. It also includes corresponding updates to various test files to reflect the new URL-encoded format for tokens and masks. I have reviewed the changes and suggest using CultureInfo.InvariantCulture when converting values to strings to ensure consistent formatting across different locales, as the current implementation relies on the thread's culture.
| { | ||
| var list = queryParams.OrderBy(kvp => kvp.Key) | ||
| .Select(kvp => $"{kvp.Key}={kvp.Value}"); | ||
| .Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(kvp.Value?.ToString() ?? string.Empty)}"); |
There was a problem hiding this comment.
Using kvp.Value?.ToString() formats the value using the current thread's culture. If a query parameter value is a culture-sensitive type (such as a floating-point number or a date), it could be formatted differently depending on the machine's locale (e.g., using a comma , instead of a dot . as a decimal separator). This can lead to API request failures on servers expecting invariant culture formatting.
To ensure consistent and culture-insensitive formatting, use Convert.ToString(kvp.Value, CultureInfo.InvariantCulture).
.Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, System.Globalization.CultureInfo.InvariantCulture))}");
lahirumaramba
left a comment
There was a problem hiding this comment.
Thanks! Overall LGTM! Added a couple of minor comments.
| { | ||
| var list = queryParams.OrderBy(kvp => kvp.Key) | ||
| .Select(kvp => $"{kvp.Key}={kvp.Value}"); | ||
| .Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, CultureInfo.InvariantCulture))}"); |
There was a problem hiding this comment.
super nit: This line is a bit long (146 chars). Can we split the key/value encoding across lines to make it easier to read?
| .Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, CultureInfo.InvariantCulture))}"); | |
| .Select(kvp => | |
| { | |
| var key = Uri.EscapeDataString(kvp.Key); | |
| var value = Uri.EscapeDataString( | |
| Convert.ToString(kvp.Value, CultureInfo.InvariantCulture)); | |
| return $"{key}={value}"; | |
| }); |
There was a problem hiding this comment.
Done, split across lines.
Description
Updates
HttpUtils.EncodeQueryParamsto percent-encode query parameter keys and string values usingUri.EscapeDataString, ensuring special characters (such as+,=,&, and#) in query parameters likepageTokenare properly encoded in outgoing HTTP requests.Testing
HttpUtilsTestcovering query parameter encoding.TenantManagerTest,OidcProviderConfigTest,SamlProviderConfigTest, andFirebaseUserManagerTest.