javaspringspring-booturltomcat

Tomcat and Spring: Issue with Query Param Being Truncated (EVAL Keyword)

I’m encountering an issue with my Spring application running on a standalone Tomcat server (version 8.5.92), where a query parameter value is getting truncated under specific conditions.

Problem: I’m making the following POST request using Postman and cURL to my Spring Boot application:

curl --location 'http://localhost:8085/studies/S_STD01(TEST)/roles?siteOid=S_EVAL(TEST)'

The issue is that when the query parameter siteOid=S_EVAL(TEST) is sent, my Spring controller only receives the value S_. However, if I change the value of siteOid to something like S_EVAL- (i.e., replacing () with -), the value is correctly passed to the controller as S_EVAL-.

It appears that EVAL() is being treated as some kind of special keyword or expression, which is causing the truncation of the query parameter value.

Tomcat Connector Configuration:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxParameterCount="1000"
           relaxedPathChars="[]|"
           relaxedQueryChars="()[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" />

Environment:

  1. Tomcat Version: 8.5.92
  2. Spring Version: 5.3.27
  3. OS: Ubuntu 22.04.4 LTS

Any help or insights into this issue would be greatly appreciated!

Solution

  • Check you filters. One of them overwrite your params.