arpitjain099 opened a new pull request, #68454:
URL: https://github.com/apache/doris/pull/68454
### What problem does this PR solve?
Issue Number: none
Problem Summary:
`url_decode` reads the two characters after a `%` with an `istringstream`,
which is happy with a partial match. `a%1gb` decodes to `a\x01b` and the `g` is
dropped. The FE folds the same function through `java.net.URLDecoder`, which
raises on that input, so the two sides disagree on it.
Stream load then ignores the bool entirely:
```cpp
url_decode(req->param(HTTP_DB_KEY), &ctx->db);
url_decode(req->param(HTTP_TABLE_KEY), &ctx->table);
```
`url_decode` clears its output before it starts, so on a malformed escape
the caller is left holding the prefix decoded so far. `PUT
/api/prod%zzbackup/t/_stream_load` loads into `prod`.
Now a `%` must be followed by two hex digits, and stream load fails the
request if either name does not decode. The SQL function already checked the
result, so it picks up the stricter parse for free.
While I was in there: `be/test/util/url_coding_test.cpp` was sitting in the
"todo: need fix those ut" list in `be/test/CMakeLists.txt`, still calling the
old `UrlDecode`/`Base64Encode`/`hive_compat` API. Ported it to the current
names and put it back in the build, with the malformed cases added.
### Release note
`url_decode` rejects a `%` not followed by two hexadecimal digits, and
stream load fails the request rather than using a truncated database or table
name.
### Check List (For Author)
- Test: Unit Test
- `be/test/util/url_coding_test.cpp`, revived and extended.
- No BE build on this machine, so I compiled `url_coding.cpp` and that
test on their own against real gtest: 6 tests pass, and the malformed-escape
one fails on master. The stream load side is a source change I have not run; CI
and a reviewer's eye are the check there.
- Behavior changed: Yes, as described in the release note.
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
