Merge pull request #1193 from shockey/bug/1184-rfc3986-query-param-value-escaping

OAS3 Query Parameter value escaping

Author: shockey

src/execute/oas3/parameter-builders.js

@@ -43,7 +43,7 @@ function query({req, value, parameter}) {
             key: k,
             value: v,
             style: 'deepObject',
-            escape: !parameter.allowReserved,
+            escape: parameter.allowReserved ? 'unsafe' : 'reserved',
           }),
           skipEncoding: true
         }
@@ -66,8 +66,9 @@ function query({req, value, parameter}) {
             key: k,
             value: v,
             style: parameter.style || 'form',
-            escape: !parameter.allowReserved,
-          })
+            escape: parameter.allowReserved ? 'unsafe' : 'reserved',
+          }),
+          skipEncoding: true
         }
       })
     }
@@ -78,7 +79,7 @@ function query({req, value, parameter}) {
           value,
           style: parameter.style || 'form',
           explode: typeof parameter.explode === 'undefined' ? true : parameter.explode,
-          escape: !parameter.allowReserved,
+          escape: parameter.allowReserved ? 'unsafe' : 'reserved',
         }),
         skipEncoding: true
       }

src/execute/oas3/style-serializer.js

@@ -1,5 +1,36 @@
 import encodeToRFC3986 from 'encode-3986'
 
+const isRfc3986Reserved = char => ':/?#[]@!$&\'()*+,;='.indexOf(char) > -1
+const isRrc3986Unreserved = (char) => {
+  return (/^[a-z0-9\-._~]+$/i).test(char)
+}
+
+function encodeDisallowedCharacters(str, {escape}) {
+  if (typeof str === 'number') {
+    str = str.toString()
+  }
+  if (typeof str !== 'string' || !str.length) {
+    return str
+  }
+
+  if (!escape) {
+    return str
+  }
+
+  return str.split('').map((char) => {
+    if (isRrc3986Unreserved(char)) {
+      return char
+    }
+
+    if (isRfc3986Reserved(char) && escape === 'unsafe') {
+      return char
+    }
+
+    // percent-encode: char -> ASCII code point num -> hex string -> upcase
+    return `%${char.charCodeAt(0).toString(16).toUpperCase()}`
+  }).join('')
+}
+
 export default function (config) {
   const {value} = config
 
@@ -9,14 +40,13 @@ export default function (config) {
   else if (typeof value === 'object') {
     return encodeObject(config)
   }
-
   return encodePrimitive(config)
 }
 
-const escapeFn = str => encodeURIComponent(str)
-
 function encodeArray({key, value, style, explode, escape}) {
-  const valueEncoder = escape ? a => encodeToRFC3986(a) : a => a
+  const valueEncoder = str => encodeDisallowedCharacters(str, {
+    escape
+  })
 
   if (style === 'simple') {
     return value.map(val => valueEncoder(val)).join(',')
@@ -36,25 +66,26 @@ function encodeArray({key, value, style, explode, escape}) {
   }
 
   if (style === 'form') {
-    const commaValue = escape ? escapeFn(',') : ','
-    const after = explode ? `&${key}=` : commaValue
+    const after = explode ? `&${key}=` : ','
     return value.map(val => valueEncoder(val)).join(after)
   }
 
   if (style === 'spaceDelimited') {
     const after = explode ? `${key}=` : ''
-    return value.map(val => valueEncoder(val)).join(`${escapeFn(' ')}${after}`)
+    return value.map(val => valueEncoder(val)).join(` ${after}`)
   }
 
   if (style === 'pipeDelimited') {
     const after = explode ? `${key}=` : ''
-    const separator = escape ? escapeFn('|') : '|'
-    return value.map(val => valueEncoder(val)).join(`${separator}${after}`)
+    return value.map(val => valueEncoder(val)).join(`|${after}`)
   }
 }
 
 function encodeObject({key, value, style, explode, escape}) {
-  const valueEncoder = escape ? a => encodeToRFC3986(a) : a => a
+  const valueEncoder = str => encodeDisallowedCharacters(str, {
+    escape
+  })
+
   const valueKeys = Object.keys(value)
 
   if (style === 'simple') {
@@ -107,8 +138,10 @@ function encodeObject({key, value, style, explode, escape}) {
   }
 }
 
-function encodePrimitive({key, value, style, explode, escape}) {
-  const valueEncoder = escape ? a => encodeToRFC3986(a) : a => a
+function encodePrimitive({key, value, style, escape}) {
+  const valueEncoder = str => encodeDisallowedCharacters(str, {
+    escape
+  })
 
   if (style === 'simple') {
     return valueEncoder(value)