Parameters in User Secrets containing `&` are converted to contain `\u0026` instead

[fdohrendorfG]

Sometime Parameters in the User Secrets secret are being modified to contain \u0026 instead of &.

So this

{
    "Parameters:token": "some=thing&looking=url&like=true"
}

is turned into this

{
    "Parameters:token": "some=thing\u0026looking=url\u0026like=true"
}

Being used like this:

var builder = DistributedApplication.CreateBuilder(args);
var token = builder.AddParameter("token", secret: true);
var sqlServer = builder.AddSqlServer("sql")
    .WithEnvironment("TOKEN", token);
builder.Build().Run();

I haven't found the exact cause when this happens.

I just noticed, that I also have a password that suddenly did not work anymore: P\u002BqMWNzkn*xm1rhXNF5st0.
So also happening for \u002B or + character.

VS: Version 17.12.0 Preview 1.0
Aspire 8.2.0 (Could also have been the previous version, as it is hard to determine when it happend)

[martincostello]

This is an artifact of the default settings for System.Text.Json when it serializes data: https://learn.microsoft.com/dotnet/standard/serialization/system-text-json/character-encoding

[fdohrendorfG]

@martincostello
I see, so the fix would be to disable this encoding?
I would argue that it feels unexpected to not see the same raw values in this file.

I can try myself on that, if not picked up by the team.

[maddymontaquila]

Can you please send us a repro when you get a chance? And let us know if disabling encoding works!

[fdohrendorfG]

VS latest
Aspire 8.2.0

1. Create new AppHost project
2. Reference System.Text.Json 8.0.4 (to fix vulnerability / seems related)
3. Open User Secrets
4. Add

{
  "SomeValue": "+"
}

5. Edit Program.cs like so:

var p = ParameterResourceBuilderExtensions.CreateDefaultPasswordParameter(builder, "mySecret",
    minLower: 1, minUpper: 1, minNumeric: 1);

builder.AddContainer("busybox", "busybox")
    .WithEnvironment("Y", p.Value);

6. Start AppHost
7. Observe user secrets being changed to:

{
  "SomeValue": "\u002B",
  "Parameters:mySecret": "<RANDOM>"
}