Tomcat and Spring: Issue with Query Param Being Truncated (EVAL Keyword)

I’m encountering an issue with my Spring application running on a standalone Tomcat server (version 8.5.92), where a query parameter value is getting truncated under specific conditions.

Problem:
I’m making the following POST request using Postman and cURL to my Spring Boot application:

curl --location 'http://localhost:8085/studies/S_STD01(TEST)/roles?siteOid=S_EVAL(TEST)'

The issue is that when the query parameter siteOid=S_EVAL(TEST) is sent, my Spring controller only receives the value S_. However, if I change the value of siteOid to something like S_EVAL- (i.e., replacing () with -), the value is correctly passed to the controller as S_EVAL-.

It appears that EVAL() is being treated as some kind of special keyword or expression, which is causing the truncation of the query parameter value.

Tomcat Connector Configuration:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxParameterCount="1000"
           relaxedPathChars="[]|"
           relaxedQueryChars="()[]|{}^\`&quot;&lt;&gt;" />

Environment:

Tomcat Version: 8.5.92
Spring Version: 5.3.27
OS: Ubuntu 22.04.4 LTS

Any help or insights into this issue would be greatly appreciated!

You need to sign in to view this answers

Related Post