Skip to content

fix(auth): URL-encode query parameter keys and values in HttpUtils - #582

Merged
macastelaz merged 5 commits into
mainfrom
fix-query-param-encoding
Oct 21, 2026
Merged

macastelaz merged 5 commits into
mainfrom
fix-query-param-encoding

Conversation

@macastelaz

Copy link
Copy Markdown
Contributor

Description

Updates HttpUtils.EncodeQueryParams to percent-encode query parameter keys and string values using Uri.EscapeDataString, ensuring special characters (such as +, =, &, and #) in query parameters like pageToken are properly encoded in outgoing HTTP requests.

Testing

  • Added unit tests in HttpUtilsTest covering query parameter encoding.
  • Updated and added unit tests in TenantManagerTest, OidcProviderConfigTest, SamlProviderConfigTest, and FirebaseUserManagerTest.

@macastelaz
macastelaz requested a review from a team October 20, 2026 16:01

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the HttpUtils.EncodeQueryParams method to properly escape query parameter keys and values using Uri.EscapeDataString. It also includes corresponding updates to various test files to reflect the new URL-encoded format for tokens and masks. I have reviewed the changes and suggest using CultureInfo.InvariantCulture when converting values to strings to ensure consistent formatting across different locales, as the current implementation relies on the thread's culture.

{
var list = queryParams.OrderBy(kvp => kvp.Key)
.Select(kvp => $"{kvp.Key}={kvp.Value}");
.Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(kvp.Value?.ToString() ?? string.Empty)}");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using kvp.Value?.ToString() formats the value using the current thread's culture. If a query parameter value is a culture-sensitive type (such as a floating-point number or a date), it could be formatted differently depending on the machine's locale (e.g., using a comma , instead of a dot . as a decimal separator). This can lead to API request failures on servers expecting invariant culture formatting.

To ensure consistent and culture-insensitive formatting, use Convert.ToString(kvp.Value, CultureInfo.InvariantCulture).

                    .Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, System.Globalization.CultureInfo.InvariantCulture))}");

@lahirumaramba lahirumaramba left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Overall LGTM! Added a couple of minor comments.

{
var list = queryParams.OrderBy(kvp => kvp.Key)
.Select(kvp => $"{kvp.Key}={kvp.Value}");
.Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, CultureInfo.InvariantCulture))}");

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super nit: This line is a bit long (146 chars). Can we split the key/value encoding across lines to make it easier to read?

Suggested change
.Select(kvp => $"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(Convert.ToString(kvp.Value, CultureInfo.InvariantCulture))}");
.Select(kvp =>
{
var key = Uri.EscapeDataString(kvp.Key);
var value = Uri.EscapeDataString(
Convert.ToString(kvp.Value, CultureInfo.InvariantCulture));
return $"{key}={value}";
});

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, split across lines.

@firebase firebase deleted a comment from macastelaz Oct 21, 2026
@macastelaz
macastelaz merged commit c08a653 into main Oct 21, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants