LuciferYang opened a new issue, #13238: URL: https://github.com/apache/gravitino/issues/13238
**Version** main branch **Describe what's wrong** `recursiveDecode` wraps `URLDecoder` failures into a thrown exception, so legal JDBC URLs containing a literal `%` (e.g. `password=100%`) or a once-encoded `%25` are rejected outright. `DataSourceUtils` carries a private copy of the same throwing decode that runs even earlier, on the H2-prefix check. **Error message and/or stacktrace** The URL is rejected by an exception thrown from `recursiveDecode` (a wrapped `URLDecoder` / `IllegalArgumentException` on the malformed percent escape). **How to reproduce** Pass a JDBC URL whose password contains a literal `%` (for example `...?password=100%`), or a once-encoded `%25`; connection setup rejects the URL instead of accepting it. **Additional context** Any fix must not weaken the unsafe-parameter scan: MySQL Connector/J decodes query tokens independently and ignores the URL fragment, so a malformed escape in the fragment must not stop the scan from revealing an encoded unsafe parameter name in the query. Found during a code audit of the jdbc catalog utilities. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
