You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Function parameters needs to be escaped twice
Reproduce steps
I have an entity Foo with a string key. And I can call delete method like this:
DELETE /Foo('key%253A')
The string key%3A was escaped. This works fine and key will have a proper value key%3A
Now I have a function that takes two parameters. And I call it like this:
GET /Foo/Func(val1=5,val2='key%253A')
I expect val2 to have the value key%3A while in reality the value will be key:. Meaning that somewhere inside OData this value was unescaped twice.
Expected behavior
One time escape should be enough
Additional context
The only place I found where OData directly does UnescapeDataString is inside SegmentTemplateHelpers.cs. I want to understand if this double escaping is desirable and if it is what are the rules?
Why I have to double escape function parameters but not entity operation parameters?
Assemblies affected
ASP.NET Core OData 8.2.3
Describe the bug
Function parameters needs to be escaped twice
Reproduce steps
I have an entity Foo with a string key. And I can call delete method like this:
The string
key%3A
was escaped. This works fine and key will have a proper valuekey%3A
Now I have a function that takes two parameters. And I call it like this:
I expect val2 to have the value
key%3A
while in reality the value will bekey:
. Meaning that somewhere inside OData this value was unescaped twice.Expected behavior
One time escape should be enough
Additional context
The only place I found where OData directly does
UnescapeDataString
is inside SegmentTemplateHelpers.cs. I want to understand if this double escaping is desirable and if it is what are the rules?Why I have to double escape function parameters but not entity operation parameters?
Way to reproduce
Check this repository:
https://github.com/sherlock1982/odata-double-escape
Note that you can get entity
/Foo
with'key%3A'
correctly. - OKBut if you call the function
/MyFunction
with'key%3A'
the result will be 'key:' - NOKThe text was updated successfully, but these errors were encountered: