Repository navigation
Resources containing spaces cannot be read from executable jars after #52246 - #52280
Merged
philwebb merged 2 commits intoOct 17, 2026
Merged
Conversation
challa
added a commit
to challa/spring-boot
that referenced
this pull request
Oct 17, 2026
UrlEncoder encoded every character that needs encoding as a two or three byte UTF-8 sequence. A character below 0x80, such as a space, was therefore written as an invalid overlong sequence, for example %c0%a0, that UrlDecoder could not decode back to the character. As JarUrlClassLoader uses UrlEncoder to create resource URLs for nested jars, a resource whose name contains such a character could no longer be read from an executable jar. This commit encodes characters below 0x80 as a single byte. See spring-projectsgh-52280 Signed-off-by: Challa Srinivasa Reddy <challa.srinivasareddy@gmail.com>
challa
force-pushed
the
gh-url-encoder-single-byte
branch
from
October 17, 2026 14:10
0565476 to
e7c849f
Compare
spring-projects-issues
added
the
status: waiting-for-triage
philwebb
added
type: blocker
Member
|
Thank you so much @challa! You've absolutely saved the RC1 we are about to release! |
Fix `UrlEncoder` for characters below 0x80, such as a space. Prior to this commit, the encoder incorrectly skipped single byte chars that required encoding. See spring-projectsgh-52280 Signed-off-by: Challa Srinivasa Reddy <challa.srinivasareddy@gmail.com>
philwebb
force-pushed
the
gh-url-encoder-single-byte
branch
from
October 17, 2026 21:10
e7c849f to
dc53a64
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #52246,
JarUrlClassLoadercreates the URLs of resources in nested jars using the newUrlEncoder(added in 059525f).UrlEncoderencodes every character that needs encoding as a two or three byte UTF-8 sequence, so a character below0x80is written as an invalid overlong sequence. For example, a space becomes%c0%a0, whichUrlDecoderdecodes to replacement characters.As a result, when all class path URLs are nested jar URLs, which is the standard executable jar layout, a resource whose name contains a space (or
",#,%,<,>,?,[,\,],^,`,{,|or}) can no longer be read. For a nested jar containingdir with space/a#b.txt,getResource("dir with space/a#b.txt")returns a URL but opening it fails:The resource is read as expected with 4.1.x.
This change encodes characters below
0x80as a single byte. The new tests inUrlEncoderTestsandJarUrlClassLoaderTestsfail without it.Resources with supplementary characters, such as emoji, in their names didn't work with 4.1.x either and still don't, as surrogate pairs aren't combined into a single code point. I've left that out of this change to keep it focused on the regression.
I used an AI coding assistant for parts of the analysis; I reviewed and verified the change and tests myself.