Question

We have already shipped a client (.NET WinForms) application which sends customer data to Java server. While most of the data sent by client are accepted at server side, some records are truncated because of the presence of & character in it, as client sends raw & and do not URL encode it, we have fixed it by using the below code:

string dataBefore="A & B";
string dataBefore = System.Web.HttpUtility.UrlEncode(dataBefore);

It is impossible for us to update all the client applications(which are already shipped) and we are thinking of a server side fix.

With the help of Fiddler, we have made sure the data has left client in full, but when server reads as below:

//in java
String dataReceied=request.getParameter("data");

it gets truncated if data contains &

Could someone help us suggesting a server side(java) fix for this? Is it possible to access the request stream in java(instead of request.getParameter())?

Answer 1

You can get access to the raw query string using HttpServletRequest.getQueryString() (javadoc), which:

returns a String containing the query string or null if the URL contains no query string. The value is not decoded by the container.

You can them perform manual decoding on that string, instead of using getParameter().

@Wesley’s idea of using getParameterMap() may not be useful, because you don’t know which order the parameters were supplied in.

I’d suggest implementing this logic as a servlet filter, to decouple the fixing of the broken parameters from your actual servlet logic. This would involve writing a custom subclass of HttpServletRequestWrapper which overrides getParameter() and manuyally decodes the query string. Your servlet would then be able to use the HttpServletrequest API as though everything was tickety boo.