tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Doug Donohoe <>
Subject URL decoding of plus (aka space) isn't done
Date Tue, 13 May 2008 15:41:23 GMT

I'm tracking down a bug in Wicket that appears in Tomcat (also Jetty).  The
issue is this:

I'm submitting a URL with spaces and pluses in it.  It is URL encoded (using as follows:


On both Tomcat and Jetty, the request.getServletPath() call returns this:


Only the %2B (+) encodings are URL-decoded.  The + (space) encodings are
left as-is.  As you can see, through this process some information is lost
(what the original pluses were).

This happens in Tomcat in CoyoteAdapter:393:

req.getURLDecoder().convert(decodedURI, false);

The 'false' is for the "query" param, which when false, skips converting of

Jetty's code is similar - it just ignores '+' altogether.

My question is this.  If it is correct to URL encode spaces with +, which
doesn't Tomcat (or Jetty) decode them?  Or is the doing
this incorrectly?  Are + only allowed in the query string portion?   There
seems to be an impedance mismatch between what a client will allow in a URL
versus what the server is expecting.  Anyone have any insight into this? 


View this message in context:
Sent from the Tomcat - Dev mailing list archive at

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message