starred/hoppscotch
1
0
Fork 0
mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00
Code Issues 711 Projects Releases 5 Packages Wiki Activity

[GH-ISSUE #2829] [bug]: query parameters are escaped implicitly #911

New issue
Closed
opened 2026-03-16 17:38:40 +03:00 by kerem · 23 comments
kerem commented 2026-03-16 17:38:40 +03:00
Owner
Copy link

Originally created by @liudonghua123 on GitHub (Oct 27, 2022).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/2829

Originally assigned to: @maneeshms on GitHub.

Is there an existing issue for this?

  • I have searched the existing issues

Current behavior

When I send a Get request with the following parameters(in bulk edit).

token: token_part1 token_part2
attrs: password%3Dabc

The actual request sent is url?token=token_part1+token_part2&attrs=password%253Dabc which is wrong for my server.

If I send the same Get request using postman, the actual request sent is url?token=token_part1%20token_part2&attrs=password%3Dabc which is correct for my server.

I found the problem code is around the following code.

github.com/hoppscotch/hoppscotch@dc80cc80e6/packages/hoppscotch-app/src/helpers/strategies/ExtensionStrategy.ts (L64-L70)

url=new URL("http://localhost")
url.searchParams.append('token','token_part1 token_part2')
url.searchParams.append('attrs','password%3Dabc')
console.info(url.toString()) // http://localhost/?token=token_part1+token_part2&attrs=password%253abc

url=new URL('http://localhost/?token=token_part1+token_part2&attrs=password%253abc')
console.info(url.searchParams.get('token')) // token_part1 token_part2
console.info(url.searchParams.get('attrs')) // password%3Dabc
console.info(decodeURI('http://localhost/?token=token_part1+token_part2&attrs=password%253abc')) // http://localhost/?token=token_part1+token_part2&attrs=password%3Dabc

See also https://developer.mozilla.org/en-US/docs/Web/API/URL/toString, https://javascript.info/url, https://url.spec.whatwg.org/#URL-stringification-behavior.

Steps to reproduce

  1. Go to Parameters tab, click Bulk edit.
  2. Fill with the following contents
token: token_part1 token_part2
attrs: password%3Dabc
  1. Click Send button to make the request.

Environment

Release

Version

Cloud

Originally created by @liudonghua123 on GitHub (Oct 27, 2022). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/2829 Originally assigned to: @maneeshms on GitHub. ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When I send a `Get` request with the following parameters(in bulk edit). ``` token: token_part1 token_part2 attrs: password%3Dabc ``` The actual request sent is `url?token=token_part1+token_part2&attrs=password%253Dabc` which is wrong for my server. If I send the same `Get` request using postman, the actual request sent is `url?token=token_part1%20token_part2&attrs=password%3Dabc` which is correct for my server. I found the problem code is around the following code. https://github.com/hoppscotch/hoppscotch/blob/dc80cc80e6e9c02c41a0754dfa7868f7f102964a/packages/hoppscotch-app/src/helpers/strategies/ExtensionStrategy.ts#L64-L70 ```js url=new URL("http://localhost") url.searchParams.append('token','token_part1 token_part2') url.searchParams.append('attrs','password%3Dabc') console.info(url.toString()) // http://localhost/?token=token_part1+token_part2&attrs=password%253abc url=new URL('http://localhost/?token=token_part1+token_part2&attrs=password%253abc') console.info(url.searchParams.get('token')) // token_part1 token_part2 console.info(url.searchParams.get('attrs')) // password%3Dabc console.info(decodeURI('http://localhost/?token=token_part1+token_part2&attrs=password%253abc')) // http://localhost/?token=token_part1+token_part2&attrs=password%3Dabc ``` See also https://developer.mozilla.org/en-US/docs/Web/API/URL/toString, https://javascript.info/url, https://url.spec.whatwg.org/#URL-stringification-behavior. ### Steps to reproduce 1. Go to `Parameters` tab, click `Bulk edit`. 2. Fill with the following contents ``` token: token_part1 token_part2 attrs: password%3Dabc ``` 3. Click `Send` button to make the request. ### Environment Release ### Version Cloud
kerem 2026-03-16 17:38:40 +03:00
kerem commented 2026-03-16 17:38:56 +03:00
Author
Owner
Copy link

@liudonghua123 commented on GitHub (Oct 27, 2022):

If I send the request with the following parameters.

token: token_part1 token_part2
attrs: password%3Dabc

Then the request is ok. It seems the space in url query string can be encode/escape as + or %20. Both of them work.

So maybe the request works in postman is because it checks whether some spaces are in the parameters or not, encodeURIComponent is called if some spaces are included. It will NOT encode/escape the parameters.

A config setting toggles the encode/escape functionality would be nice for test purposes.

<!-- gh-comment-id:1293112601 --> @liudonghua123 commented on GitHub (Oct 27, 2022): If I send the request with the following parameters. ``` token: token_part1 token_part2 attrs: password%3Dabc ``` Then the request is ok. It seems the space in url query string can be `encode/escape` as `+` or `%20`. Both of them work. So maybe the request works in postman is because it checks whether some spaces are in the parameters or not, `encodeURIComponent` is called if some spaces are included. It will NOT `encode/escape` the parameters. A config setting toggles the `encode/escape` functionality would be nice for test purposes.
kerem commented 2026-03-16 17:39:01 +03:00
Author
Owner
Copy link

@liudonghua123 commented on GitHub (Oct 27, 2022):

The space character is the only character that has two acceptable URL-encoded representations. Instead of encoding a space as “%20,” you can use the plus sign reserved character to represent a space.

https://www.fullhost.com/blog/what-does-20-mean-in-a-web-address/

url1=new URL('http://localhost/?token=token_part1+token_part2&attrs=password%253abc')
url2=new URL('http://localhost/?token=token_part1%20token_part2&attrs=password%253abc')
console.info(url1.searchParams.get('token')) // token_part1 token_part2
console.info(url2.searchParams.get('token')) // token_part1 token_part2
console.info(url1.searchParams.get('token') === url2.searchParams.get('token')) // true
<!-- gh-comment-id:1293129274 --> @liudonghua123 commented on GitHub (Oct 27, 2022): > The space character is the only character that has two acceptable URL-encoded representations. Instead of encoding a space as “%20,” you can use the plus sign reserved character to represent a space. https://www.fullhost.com/blog/what-does-20-mean-in-a-web-address/ ```js url1=new URL('http://localhost/?token=token_part1+token_part2&attrs=password%253abc') url2=new URL('http://localhost/?token=token_part1%20token_part2&attrs=password%253abc') console.info(url1.searchParams.get('token')) // token_part1 token_part2 console.info(url2.searchParams.get('token')) // token_part1 token_part2 console.info(url1.searchParams.get('token') === url2.searchParams.get('token')) // true ```
kerem commented 2026-03-16 17:39:06 +03:00
Author
Owner
Copy link

@AndrewBastin commented on GitHub (Oct 27, 2022):

Since the current implementation is correct according to the spec, we are prioritizing this as a low priority issue.

PR contributions for implementing the toggle for considering both ways are welcome in the meantime :)

<!-- gh-comment-id:1293980390 --> @AndrewBastin commented on GitHub (Oct 27, 2022): Since the current implementation is correct according to the spec, we are prioritizing this as a low priority issue. PR contributions for implementing the toggle for considering both ways are welcome in the meantime :)
kerem commented 2026-03-16 17:39:11 +03:00
Author
Owner
Copy link

@Rathan-Naik commented on GitHub (Jan 1, 2023):

Just getting started on contributions @AndrewBastin I can work on implementing the toggle.

<!-- gh-comment-id:1368508168 --> @Rathan-Naik commented on GitHub (Jan 1, 2023): Just getting started on contributions @AndrewBastin I can work on implementing the toggle.
kerem commented 2026-03-16 17:39:16 +03:00
Author
Owner
Copy link

@AndrewBastin commented on GitHub (Jan 6, 2023):

Cool @Rathan-Naik, please do let me know if you need any help/guidance.

Assigning the task to you.

<!-- gh-comment-id:1372967783 --> @AndrewBastin commented on GitHub (Jan 6, 2023): Cool @Rathan-Naik, please do let me know if you need any help/guidance. Assigning the task to you.
kerem commented 2026-03-16 17:39:22 +03:00
Author
Owner
Copy link

@Ahishekoza commented on GitHub (Jan 28, 2023):

Hello @AndrewBastin,
I would like to contribute to this issue

<!-- gh-comment-id:1407306491 --> @Ahishekoza commented on GitHub (Jan 28, 2023): Hello @AndrewBastin, I would like to contribute to this issue
kerem commented 2026-03-16 17:39:27 +03:00
Author
Owner
Copy link

@JManan commented on GitHub (Jun 24, 2023):

hey @AndrewBastin i would like to contribute to this issue. Please let me do it.

<!-- gh-comment-id:1605702626 --> @JManan commented on GitHub (Jun 24, 2023): hey @AndrewBastin i would like to contribute to this issue. Please let me do it.
kerem commented 2026-03-16 17:39:32 +03:00
Author
Owner
Copy link

@AndrewBastin commented on GitHub (Jun 26, 2023):

@JManan sure.

<!-- gh-comment-id:1606597688 --> @AndrewBastin commented on GitHub (Jun 26, 2023): @JManan sure.
kerem commented 2026-03-16 17:39:37 +03:00
Author
Owner
Copy link

@Pheonix075 commented on GitHub (Aug 7, 2023):

hey @AndrewBastin I would like to contribute to this issue.give me a chance

<!-- gh-comment-id:1668271452 --> @Pheonix075 commented on GitHub (Aug 7, 2023): hey @AndrewBastin I would like to contribute to this issue.give me a chance
kerem commented 2026-03-16 17:39:42 +03:00
Author
Owner
Copy link

@VinayakSingh2001 commented on GitHub (Aug 18, 2023):

Hey @tejakummarikuntla I would like to work on this, can you please assign this to me !!

<!-- gh-comment-id:1683350166 --> @VinayakSingh2001 commented on GitHub (Aug 18, 2023): Hey @tejakummarikuntla I would like to work on this, can you please assign this to me !!
kerem commented 2026-03-16 17:39:47 +03:00
Author
Owner
Copy link

@tejakummarikuntla commented on GitHub (Aug 18, 2023):

Sorry @VinayakSingh2001 , I don't think I can help you here. Did you mean to tag @AndrewBastin ?

<!-- gh-comment-id:1683454581 --> @tejakummarikuntla commented on GitHub (Aug 18, 2023): Sorry @VinayakSingh2001 , I don't think I can help you here. Did you mean to tag @AndrewBastin ?
kerem commented 2026-03-16 17:39:52 +03:00
Author
Owner
Copy link

@yashnirmal commented on GitHub (Sep 14, 2023):

Hey @tejakummarikuntla is the issue still open?

<!-- gh-comment-id:1719640876 --> @yashnirmal commented on GitHub (Sep 14, 2023): Hey @tejakummarikuntla is the issue still open?
kerem commented 2026-03-16 17:39:57 +03:00
Author
Owner
Copy link

@liudonghua123 commented on GitHub (Sep 15, 2023):

No PR currently?

I suggest to add a configuration named Encode(Encode the query params, three options provided, enable means always encode the params, disable means do not encode the params and auto means encode the params which contain some common special characters need to encode).

And only two group of settings available now, one for Theme, another for Interceptor. Maybe a new group named Other is a good idea for this new Encode setting.

<!-- gh-comment-id:1720785892 --> @liudonghua123 commented on GitHub (Sep 15, 2023): No PR currently? I suggest to add a configuration named Encode(Encode the query params, three options provided, enable means always encode the params, disable means do not encode the params and auto means encode the params which contain some common special characters need to encode). And only two group of settings available now, one for `Theme`, another for `Interceptor`. Maybe a new group named `Other` is a good idea for this new `Encode` setting.
kerem commented 2026-03-16 17:40:02 +03:00
Author
Owner
Copy link

@meetdhanani17 commented on GitHub (Oct 2, 2023):

it is need to add a toggle like space as %20 or + or i change to direct convert space as %20?

<!-- gh-comment-id:1742448849 --> @meetdhanani17 commented on GitHub (Oct 2, 2023): it is need to add a toggle like space as %20 or + or i change to direct convert space as %20?
kerem commented 2026-03-16 17:40:07 +03:00
Author
Owner
Copy link

@maneeshms commented on GitHub (Dec 28, 2023):

@tejakummarikuntla If this issue is still open and no PR raised yet, i would like to give a try.

<!-- gh-comment-id:1870781368 --> @maneeshms commented on GitHub (Dec 28, 2023): @tejakummarikuntla If this issue is still open and no PR raised yet, i would like to give a try.
kerem commented 2026-03-16 17:40:12 +03:00
Author
Owner
Copy link

@liyasthomas commented on GitHub (Dec 28, 2023):

Assigning to @maneeshms.

<!-- gh-comment-id:1870793295 --> @liyasthomas commented on GitHub (Dec 28, 2023): Assigning to @maneeshms.
kerem commented 2026-03-16 17:40:18 +03:00
Author
Owner
Copy link

@TheDynamicPunk commented on GitHub (May 16, 2024):

Hey @liyasthomas it's been a while since there has been some activity on this thread. If you've still not received any PR's for this, maybe I can take a look with some assistance from you?

<!-- gh-comment-id:2115449812 --> @TheDynamicPunk commented on GitHub (May 16, 2024): Hey @liyasthomas it's been a while since there has been some activity on this thread. If you've still not received any PR's for this, maybe I can take a look with some assistance from you?
kerem commented 2026-03-16 17:40:23 +03:00
Author
Owner
Copy link

@Vaibhav-tech22 commented on GitHub (Jul 25, 2024):

Hey @liyasthomas, I see there are no activities on this bug. If no PRs have been raised in this matter. I would like to give it a try. Thanks.

<!-- gh-comment-id:2250873856 --> @Vaibhav-tech22 commented on GitHub (Jul 25, 2024): Hey @liyasthomas, I see there are no activities on this bug. If no PRs have been raised in this matter. I would like to give it a try. Thanks.
kerem commented 2026-03-16 17:40:28 +03:00
Author
Owner
Copy link

@mohitsourav7 commented on GitHub (Sep 13, 2024):

Hi @AndrewBastin I see there are no activities on this bug .If you still haven't received any PR yet. I would like to give it a try

Regards

<!-- gh-comment-id:2348160298 --> @mohitsourav7 commented on GitHub (Sep 13, 2024): Hi @AndrewBastin I see there are no activities on this bug .If you still haven't received any PR yet. I would like to give it a try Regards
kerem commented 2026-03-16 17:40:33 +03:00
Author
Owner
Copy link

@satwikkini-01 commented on GitHub (Oct 2, 2024):

Hello Mr @AndrewBastin , even I would like to give a try to solve this issue.
This will be my first open source contribution :)

<!-- gh-comment-id:2389481767 --> @satwikkini-01 commented on GitHub (Oct 2, 2024): Hello Mr @AndrewBastin , even I would like to give a try to solve this issue. This will be my first open source contribution :)
kerem commented 2026-03-16 17:40:38 +03:00
Author
Owner
Copy link

@AndrewBastin commented on GitHub (Oct 7, 2024):

@satwikkini-01 @mohitsourav7 if you are interested in opening a PR, feel free to do so, you do not need to wait on an assignment : )

<!-- gh-comment-id:2397175032 --> @AndrewBastin commented on GitHub (Oct 7, 2024): @satwikkini-01 @mohitsourav7 if you are interested in opening a PR, feel free to do so, you do not need to wait on an assignment : )
kerem commented 2026-03-16 17:40:43 +03:00
Author
Owner
Copy link

@Pranay-Pandey commented on GitHub (Oct 7, 2024):

Hey, @AndrewBastin
I have raised a PR, with the changes suggested by @liudonghua123 .
But with these changes it seems the encoding takes place twice.
image
Any suggestions?

<!-- gh-comment-id:2397912609 --> @Pranay-Pandey commented on GitHub (Oct 7, 2024): Hey, @AndrewBastin I have raised a PR, with the changes suggested by @liudonghua123 . But with these changes it seems the encoding takes place twice. ![image](https://github.com/user-attachments/assets/eb3f2f38-4525-419c-9605-2907ee0a3f3a) Any suggestions?
kerem commented 2026-03-16 17:40:48 +03:00
Author
Owner
Copy link

@jamesgeorge007 commented on GitHub (Nov 1, 2024):

#4412 Released in v2024.10.0.

<!-- gh-comment-id:2452307020 --> @jamesgeorge007 commented on GitHub (Nov 1, 2024): #4412 Released in [v2024.10.0](https://github.com/hoppscotch/hoppscotch/releases/tag/2024.10.0).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
chore/security-fix-2026-4-0
next
fix/mockserver-env-set-url-priority
feat/rest-gql-merge
refactor/workspaces
fix/onboarding-mass-assignment
desktop-settings-phase-0-schema-bridge-shell
patch
test-webhook
pr/johnan319/5745
tembo/optimize-performance-db-queries
add-claude-github-actions-1772782423108
fix/code-scanning-103
fix/mock-server-example-endpoint-match-v2
fix/rate-limit-on-health-route
hotfix/api-doc-collection-deletetion
cd-test
fix/mock-server-backend-followup
chore/code-scanning-52
chore/verion-addition-check
nested-migrations
scripting-system-updates-worker-setup
scripting-system-updates
pr/shipko/4367
ci-test
feat/user-delete-condition
feat/user-workspace-stats-api
chore/collection-export-addition
fix/import-file-size-limit-flow
feat/dashboard-common
feat/sort-environment-alphabetically
feat/infra-config-encryption
refactor/team
feat/collection-duplicationn
feat/secure-cookies-toggle
pr/pavog/4195
pr/pavog/4196
test/patch-demo
feat/native-interceptor-updates
pr/AndrewBastin/4111
feat/user-last-active-on
fix/codemirror-large-text-scroll-bug
fix/precision-lost-beautify
fix/env-diff-test-schema-error
fix/email-case-sensitive
release/2024.3.3
refactor/workspace-login-conversion
feat/node-apline-version-upgrade
feat/seed
release/2024.3.2
fix/sh-email-handlebar-issue
feat/app-experiment-animation
release/2024.3.1
release/2024.3.0
pr/jamesgeorge007/3937
experiment/deploychan
feat/github-enterprise-auth
refactor/collection-search-query
hotfix/infra-config-reset-bug
fix/secret-var-bug
hotfix/full-text-search
hotfix/request-variable-version-syncing
feat/request-variable
feat/server-config-additional-properties
pr/JoelJacobStephen/3845
release/2023.12.6
fix/safari-codemirror-perf-bug
release/2023.12.5
release/2023.12.4
fix/secret-env-bugs-tooltip
release/2023.12.3
fix/shared-request-bug
fix/disable-context-menu-option
release/2023.12.2
release/2023.12.1
fix/shared-request-bugs
release/2023.12.0
fix/gql-history-schema
fix/actions-not-working-without-sidebar
pr/jamesgeorge007/3665
chore/desktop-app-corrections
fix/auth-headers-in-coll
fix/embed-url
improve/placeholder
add-realtime-logos
feat/shared-request-embeds
feat/collection-headers
revamp/header
release/2023.8.4
refactor/interceptor-error-display
feat/subpath-based-access
release/2023.8.3
feat/shared-requests
feat/desktop
fix/nodemailer-templates-issue
feature/upgrade-graphql-ws
fix/graphql-crashing
fix/set-environments-when-no-env-selected
refactor/pre-prisma-bump-setup
release/2023.8.2
pr/danitherex/3216
perf/raw-db-query
release/2023.8.1
revert-3348-perf/reduce-backend-calls
fix/incorrect-tab-count-close-all-tab
fix/duplicate-tab-bug
release/2023.8.0
hotfix/fetch-shortcode
fix/tab-right-click-rename-bug
chore/docker-fixes
pr/JoelJacobStephen/3178
feat/fe-accessible-auth-provider-env
feat-cherry-pick/conditional-auth-select
feat/conditional-auth-select
release/2023.4.8
fix/generate-sitemap-issue
test/backend-test-case
refactor/team-invitation
pr/AndrewBastin/3171
release/2023.4.7
fix/duplicate-team-invite
fix/unified-bg-color-coll-tree
fix/shortcode-screen-stuck
release/2023.4.6
revert-3117-patch-3
fix/env-selector-bg
fix/db-url
release/2023.4.4
fix/sync-popup-bug
fix/team-env-set-test
chore/wss-to-ws-on-env
fix/prettify-xml-response
feat/db-volume-addition
feat/env-selector-tabs-ui
bug/broken-env
release/2023.4.2
fix/switch-workspace-env-bug
fix/magic-link
fix/cookie-handler
HPS-OSS-1
staging
revert/auth-issue
feat/export-env
refactor/commons
reference/path-variables
orphan-pr/2243
feat/realtime-search
fix/save-override
refactor/strategies
feat/embeds
bug/withDefaults
feat/show-keys
refactor/toast
2026.3.1
2026.3.0
2026.2.1
2026.2.0
2026.1.1
2026.1.0
2025.12.1
2025.12.0
2025.11.2
2025.11.1
2025.11.0
2025.10.1
2025.10.0
2025.9.2
2025.9.1
2025.9.0
2025.8.1
2025.8.0
2025.7.1
2025.7.0
2025.6.1
2025.6.0
2025.5.4
2025.5.3
2025.5.2
2025.5.1
2025.5.0
2025.4.2
2025.4.1
2025.4.0
2025.3.2
2025.3.1
2025.3.0
2025.2.3
2025.2.2
2025.2.1
2025.2.0
2025.1.1
2025.1.0
2024.12.2
2024.12.1
2024.12.0
2024.11.0
2024.10.2
2024.10.1
2024.10.0
2024.9.3
2024.9.2
2024.9.1
2024.9.0
2024.8.3
2024.8.2
2024.8.1
2024.8.0
2024.7.2
2024.7.1
2024.7.0
2024.6.1
2024.6.0
2024.3.4
2024.3.3
2024.3.2
2024.3.1
2024.3.0
2023.12.6
2023.12.5
2023.12.4
2023.12.3
2023.12.2
2023.12.1
2023.12.0
2023.8.4
2023.8.3
2023.8.2
2023.8.1
2023.8.0
2023.4.8
2023.4.7
2023.4.6
2023.4.5
2023.4.4
2023.4.3
2023.4.2
2023.4.1
2023.4.0
v3.0.1
v3.0.0
v2.2.1
v2.2.0
v2.1.0
v2.0.0
v1.12.0
v1.10.0
v1.9.9
v1.9.7
v1.9.5
v1.9.0
v1.8.0
v1.5.0
v1.0.0
v0.1.0
Labels
Clear labels   
CodeDay

   
a11y

   
browser limited

   
bug

   
bug fix

   
cli

   
core

   
critical

   
design

   
desktop

   
discussion

   
docker

   
documentation

   
duplicate

   
enterprise

   
feature

   
feature

   
fosshack

   
future

   
good first issue

   
hacktoberfest

   
help wanted

   
i18n

   
invalid

   
major

   
minor

   
need information

   
need testing

   
not applicable to hoppscotch

   
not reproducible

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
refactor

   
resolved

   
sandbox

   
self-host

   
spam

   
stale

   
testmu

   
wip

   
wont fix
No labels
CodeDay
a11y
browser limited
bug
bug fix
cli
core
critical
design
desktop
discussion
docker
documentation
duplicate
enterprise
feature
feature
fosshack
future
good first issue
hacktoberfest
help wanted
i18n
invalid
major
minor
need information
need testing
not applicable to hoppscotch
not reproducible
pull-request
question
refactor
resolved
sandbox
self-host
spam
stale
testmu
wip
wont fix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/hoppscotch#911
No description provided.