11//
22// DISCLAIMER
33//
4- // Copyright 2017 ArangoDB GmbH, Cologne, Germany
4+ // Copyright 2017-2023 ArangoDB GmbH, Cologne, Germany
55//
66// Licensed under the Apache License, Version 2.0 (the "License");
77// you may not use this file except in compliance with the License.
1717//
1818// Copyright holder is ArangoDB GmbH, Cologne, Germany
1919//
20- // Author Ewout Prangsma
21- //
2220
2321package vst
2422
@@ -149,11 +147,17 @@ func (r *vstRequest) createMessageParts() ([][]byte, error) {
149147 if strings .HasPrefix (path , "_db/" ) {
150148 path = path [4 :] // Remove '_db/'
151149 parts := strings .SplitN (path , "/" , 2 )
150+
151+ // ensure database name is not URL-encoded
152+ dbName , err := url .QueryUnescape (parts [0 ])
153+ if err != nil {
154+ return nil , driver .WithStack (err )
155+ }
156+ databaseValue = velocypack .NewStringValue (dbName )
157+
152158 if len (parts ) == 1 {
153- databaseValue = velocypack .NewStringValue (parts [0 ])
154159 path = ""
155160 } else {
156- databaseValue = velocypack .NewStringValue (parts [0 ])
157161 path = parts [1 ]
158162 }
159163 }
@@ -162,18 +166,34 @@ func (r *vstRequest) createMessageParts() ([][]byte, error) {
162166 // Create header
163167 var b velocypack.Builder
164168 b .OpenArray ()
165- b .AddValue (velocypack .NewIntValue (1 )) // Version
166- b .AddValue (velocypack .NewIntValue (1 )) // Type (1=Req)
167- b .AddValue (databaseValue ) // Database name
168- b .AddValue (velocypack .NewIntValue (r .requestType ())) // Request type
169- b .AddValue (velocypack .NewStringValue (path )) // Request
170- b .OpenObject () // Parameters
169+
170+ // member 0: numeric version of the velocypack protocol. Must always be 1 at the moment.
171+ b .AddValue (velocypack .NewIntValue (1 ))
172+
173+ // member 1: numeric representation of the VST request type. Must always be 1 at the moment.
174+ b .AddValue (velocypack .NewIntValue (1 ))
175+
176+ // member 2: string with the database name - this must be the normalized database name, but not URL-encoded in any way!
177+ b .AddValue (databaseValue ) // Database name
178+
179+ // member 3: numeric representation of the request type (GET, POST, PUT etc.)
180+ b .AddValue (velocypack .NewIntValue (r .requestType ()))
181+
182+ // member 4: string with a relative request path, starting at /
183+ // There is no need for this path to contain the database name, as the database name is already transferred in member 2.
184+ // There is also no need for the path to contain request parameters (e.g. key=value), as they should be transferred in member 5.
185+ b .AddValue (velocypack .NewStringValue (path ))
186+
187+ // member 5: object with request parameters (e.g. { "foo": "bar", "baz": "qux" }
188+ b .OpenObject ()
171189 for k , v := range r .q {
172190 if len (v ) > 0 {
173191 b .AddKeyValue (k , velocypack .NewStringValue (v [0 ]))
174192 }
175193 }
176- b .Close () // Parameters
194+ b .Close ()
195+
196+ // member 6: object with “HTTP” headers (e.g. { "x-arango-async" : "store" }
177197 b .OpenObject () // Meta
178198 for k , v := range r .hdr {
179199 b .AddKeyValue (k , velocypack .NewStringValue (v ))
0 commit comments