Web container automatically urldecode processing of parameters in HTTP requests

Title, in Java maybe a lot of people didn't notice that when we send an HTTP request, if the accompanying parameter is UrlEncode, after reaching the Web container, the developer gets the value of the parameter will automatically become the value before encode. This is a good feature, developers can completely ignore the HTTP parameters whether it is necessary to decode this kind of thing, but decode exactly what happened?

The moment arose and sank into it, and began to find it on a layer.

The first step is to start with the Request.getparameter () method, but ServletRequest is just an interface, which is a basic interface of the servlet framework defined by the Java EE, and the implementation depends on the specific servlet container, the Web container, I'm using JBoss, so I started with the source code from JBoss. At the same time, in order to find out when we call Request.getparameter () is the method that calls which ServletRequest object, using reflection to find, the code is as follows:

System.out.println (Request.getclass (). GetName ());

It is simple to get the exact name of the object through the request's getclass, and the result is: Org.apache.catalina.connector.RequestFacade. Visible is the specific ServletRequest implementation class provided by the Web container, now that we have found the specific class, we must look at the API documentation to see if there is any mention of the decode operation on the request parameter value. By the way Org.apache.catalina.connector.RequestFacade Tomcat API, sure enough the document did not mention anything about the decode content, but see Requestfacade is just a wrapper, really work unexpectedly other people, okay , you can only find the code.

Find the source of the Requestfacade, and discover that the class that is really used to get the request parameter is a protected variable request for Requestfacade, and of course this class implements the ServletRequest interface. Continue to check the request source code, found that the real work of the class is not it, Request inside also has a variable org.apache.coyote.Request.coyoteRequest, continue to find Org.apache.coyote.Request source code. Find Org.apache.coyote.Request source code roughly can be seen in the end when the decode operation. In the Org.apache.coyote.Request constructor, you can see:

Public Request ()  {    this.parameters.setQuery (THIS.QUERYMB);    This.parameters.setURLDecoder (This.urldecoder);    This.parameters.setHeaders (this.headers);    This.methodMB.setString ("GET");    This.uriMB.setString ("/");    This.queryMB.setString ("");    This.protoMB.setString ("http/1.0");  }

One sentence this.parameters.setURLDecoder (this.urldecoder); Urldecoder tool class is specified, and then parameters can see that the class is the class used to parse the HTTP request parameters. The class uses the Urldecoder tool class to decode the name and value of the request, and here basically you see how the parameters in the HTTP request are automatically decode. It does not go into the code step, after all, we just need to know what the decode can be.

As can be seen from the entire process above, the automatic decode of HTTP parameters is Web container dependent, which is not the Java EE Standard, so other web containers may not do this, so developers have to pay attention to.

Web container automatically urldecode processing of parameters in HTTP requests