CFHTTP call removes multiple slashes from URL

Description

When calling a URL with multiple slashes, Lucees cfhttp removes multiple slashes which are valid.
Example:
https://test.com/this/is//a//valid/url
Will become:
https://test.com/this/is/a/valid/url

Example:
https://trycf.com/gist/9d8d447a9f15d078c43d69e9f4063209/lucee5

Slack conversation:
https://cfml.slack.com/archives/C06TA0A9W/p1621927532145700

The issue is present in https://github.com/lucee/Lucee/blob/6.0/core/src/main/java/lucee/commons/net/HTTPUtil.java#L167

Environment

Lucee 5.3.8.167-RC

Linked work items

relates to

LDEV-3349

CFHTTP double encodes in query string with +/plus/space

LDEV-4456

CFHTTP - Following 301 Redirect results in 403 error

Activity

Zac Spitzer 29 November 2024 at 16:31
Edited

I just hit this trying to download artifacts from github actions,

first thing was following a redirect seems to append headers to the redirects

400 Authentication information is not given in the correct format. Check the value of Authorization header

problem is

rscd=attachment%253B%2Bfilename%253D%2522Lucee-test-cross-reference-json-test-results-1389.zip%2522

get’s re-encoded as

rscd=attachment%3B+filename%3D%22Lucee-test-cross-reference-json-test-results-1389.zip%22

Pothys - MitrahSoft 26 May 2021 at 12:03
Edited

I checked this ticket and confirmed the issue happened on lucee latest version 5.3.8.178-SNAPSHOT also. In cfhttp request, if the URL path has more than one slash means it's converted to a single slash in lucee. Seems ACF works fine.

I added a testcase to this ticket
Pull Request:

Resize issue view side panel

Assignee

Zac Spitzer

Reporter

Dean Maunder

Priority

New

Labels

acf-compatcfhttp

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Parent

LDEV-5171 Fix CFHTTP url (re)-encoding problems

Sprint

7.2.0

Created 25 May 2021 at 21:02

Updated 6 March 2025 at 11:28