Prevent duplicated encoding in mvc

spring-cloud-gateway-server-mvc/src/main/java/org/springframework/cloud/gateway/server/mvc/filter/BeforeFilterFunctions.java

@@ -45,6 +45,7 @@
 import org.springframework.web.servlet.function.ServerRequest;
 import org.springframework.web.util.UriComponentsBuilder;
 import org.springframework.web.util.UriTemplate;
+import org.springframework.web.util.UriUtils;
 
 import static org.springframework.cloud.gateway.server.mvc.common.MvcUtils.CIRCUITBREAKER_EXECUTION_EXCEPTION_ATTR;
 import static org.springframework.util.CollectionUtils.unmodifiableMultiValueMap;
@@ -214,10 +215,12 @@ public static Function<ServerRequest, ServerRequest> removeRequestParameter(Stri
 			MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>(request.params());
 			queryParams.remove(name);
 
+			MultiValueMap<String, String> encodedQueryParams = UriUtils.encodeQueryParams(queryParams);
+
 			// remove from uri
 			URI newUri = UriComponentsBuilder.fromUri(request.uri())
-				.replaceQueryParams(unmodifiableMultiValueMap(queryParams))
-				.build()
+				.replaceQueryParams(unmodifiableMultiValueMap(encodedQueryParams))
+				.build(true)
 				.toUri();
 
 			// remove resolved params from request
@@ -350,9 +353,11 @@ public static Function<ServerRequest, ServerRequest> setPath(String path) {
 		return request -> {
 			Map<String, Object> uriVariables = MvcUtils.getUriTemplateVariables(request);
 			URI uri = uriTemplate.expand(uriVariables);
-			String newPath = uri.getRawPath();
 
-			URI prefixedUri = UriComponentsBuilder.fromUri(request.uri()).replacePath(newPath).build().toUri();
+			URI prefixedUri = UriComponentsBuilder.fromUri(request.uri())
+				.replacePath(uri.getRawPath())
+				.build(true)
+				.toUri();
 			return ServerRequest.from(request).uri(prefixedUri).build();
 		};
 	}
@@ -407,7 +412,7 @@ public static Function<ServerRequest, ServerRequest> stripPrefix(int parts) {
 
 			URI prefixedUri = UriComponentsBuilder.fromUri(request.uri())
 				.replacePath(newPath.toString())
-				.build()
+				.build(true)
 				.toUri();
 			return ServerRequest.from(request).uri(prefixedUri).build();
 		};

spring-cloud-gateway-server-mvc/src/test/java/org/springframework/cloud/gateway/server/mvc/filter/BeforeFilterFunctionsTests.java

@@ -0,0 +1,184 @@
+/*
+ * Copyright 2013-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.cloud.gateway.server.mvc.filter;
+
+import java.util.Collections;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
+import org.springframework.web.servlet.function.ServerRequest;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author raccoonback
+ */
+class BeforeFilterFunctionsTests {
+
+	@Test
+	void setPath() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/new/path");
+	}
+
+	@Test
+	void setEncodedPath() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.setPath("/new/é").apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/new/%C3%A9");
+	}
+
+	@Test
+	void setPathWithParameters() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
+				.queryParam("foo", "bar")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/new/path?foo=bar");
+	}
+
+	@Test
+	void setPathWithEncodedParameters() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/legacy/path")
+				.queryParam("foo[]", "bar[]")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.setPath("/new/path").apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/new/path?foo%5B%5D=bar%5B%5D");
+	}
+
+	@Test
+	void removeRequestParameter() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
+				.queryParam("foo", "bar")
+				.queryParam("baz", "qux")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);
+
+		assertThat(result.param("foo")).isEmpty();
+		assertThat(result.param("baz")).isPresent().hasValue("qux");
+		assertThat(result.uri().toString()).hasToString("http://localhost/path?baz=qux");
+	}
+
+	@Test
+	void removeEncodedRequestParameter() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
+				.queryParam("foo[]", "bar")
+				.queryParam("baz", "qux")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo[]").apply(request);
+
+		assertThat(result.param("foo[]")).isEmpty();
+		assertThat(result.param("baz")).isPresent().hasValue("qux");
+		assertThat(result.uri().toString()).hasToString("http://localhost/path?baz=qux");
+	}
+
+	@Test
+	void removeRequestParameterWithEncodedRemainParameters() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/path")
+				.queryParam("foo", "bar")
+				.queryParam("baz[]", "qux[]")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);
+
+		assertThat(result.param("foo")).isEmpty();
+		assertThat(result.param("baz[]")).isPresent().hasValue("qux[]");
+		assertThat(result.uri().toString()).hasToString("http://localhost/path?baz%5B%5D=qux%5B%5D");
+	}
+
+	@Test
+	void removeRequestParameterWithEncodedPath() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/é")
+				.queryParam("foo", "bar")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.removeRequestParameter("foo").apply(request);
+
+		assertThat(result.param("foo")).isEmpty();
+		assertThat(result.uri().toString()).hasToString("http://localhost/%C3%A9");
+	}
+
+	@Test
+	void stripPrefix() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/depth3");
+	}
+
+	@Test
+	void stripPrefixWithEncodedPath() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3/é")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);
+
+		assertThat(result.uri().toString()).hasToString("http://localhost/depth3/%C3%A9");
+	}
+
+	@Test
+	void stripPrefixWithEncodedParameters() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/depth1/depth2/depth3")
+				.queryParam("baz[]", "qux[]")
+				.buildRequest(null);
+
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ServerRequest result = BeforeFilterFunctions.stripPrefix(2).apply(request);
+
+		assertThat(result.param("baz[]")).isPresent().hasValue("qux[]");
+		assertThat(result.uri().toString()).hasToString("http://localhost/depth3?baz%5B%5D=qux%5B%5D");
+	}
+
+}