tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Doug Donohoe <>
Subject Re: URL decoding of plus (aka space) isn't done
Date Tue, 13 May 2008 15:57:40 GMT

To answer my own question:

I looked at the RFC ( and it appears
that '+' is only reserved for query strings.  The use of
for path-portions of a URL (or even an entire URL) is incorrect.


Doug Donohoe wrote:
> I'm tracking down a bug in Wicket that appears in Tomcat (also Jetty). 
> The issue is this:
> I'm submitting a URL with spaces and pluses in it.  It is URL encoded
> (using as follows:
> http://localhost:8080/bugs/home/message/message+with+spaces+and%2Bsome%2Bpluses/
> On both Tomcat and Jetty, the request.getServletPath() call returns this:
> /home/message/message+with+spaces+and+some+plusses=bug/
> Only the %2B (+) encodings are URL-decoded.  The + (space) encodings are
> left as-is.  As you can see, through this process some information is lost
> (what the original pluses were).
> This happens in Tomcat in CoyoteAdapter:393:
> req.getURLDecoder().convert(decodedURI, false);
> The 'false' is for the "query" param, which when false, skips converting
> of +
> Jetty's code is similar - it just ignores '+' altogether.
> My question is this.  If it is correct to URL encode spaces with +, which
> doesn't Tomcat (or Jetty) decode them?  Or is the
> doing this incorrectly?  Are + only allowed in the query string portion?  
> There seems to be an impedance mismatch between what a client will allow
> in a URL versus what the server is expecting.  Anyone have any insight
> into this? 
> Thanks,
> -Doug

View this message in context:
Sent from the Tomcat - Dev mailing list archive at

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message