Skip to content

Percent-encoded quotes in a q inside a JSON body (and an x-ngsiv2 typo) - #19

Open
kzangeli wants to merge 1 commit into
FIWARE:NGSI-LDfrom
kzangeli:fix/percent-encoded-quotes-in-body
Open

kzangeli wants to merge 1 commit into
FIWARE:NGSI-LDfrom
kzangeli:fix/percent-encoded-quotes-in-body

Conversation

@kzangeli

Copy link
Copy Markdown

Four subscription payloads write the q string as:

"q": "filling>0.6;filling<0.8;controlledAsset==%22urn:ngsi-ld:Building:farm001%22",

%22 is a percent-encoded double quote. Percent-decoding belongs to the URL layer, and this q is in a request body, where nothing decodes it — so the value the broker receives is literally %22urn:ngsi-ld:Building:farm001%22, which is neither a quoted string nor a URI.

A broker that validates the q grammar rejects the subscription outright:

400 Invalid q parameter — '%22urn:ngsi-ld:Building:farm001%22' is not a valid value:
a string must be quoted, and a number must not carry anything after it

So the three subscriptions this section creates are never created, and the notification examples that follow cannot fire.

The change

JSON-escaped quotes, which is what § 4.9 asks for and parses identically everywhere:

"q": "filling>0.6;filling<0.8;controlledAsset==\"urn:ngsi-ld:Building:farm001\"",

All five payloads on the page still parse as valid JSON (checked).

Also

x-nsgiv2-keyValues and x-nsgiv2-keyValues-compacted in the custom-format list are misspellings of x-ngsiv2.

Found while running all sixteen NGSI-LD tutorials against a different NGSI-LD broker. Note this may not reproduce on a broker that percent-decodes q in bodies, which is presumably why it went unnoticed.

…2 typo

Four subscription payloads write the q string as

    "q": "filling>0.6;filling<0.8;controlledAsset==%22urn:ngsi-ld:Building:farm001%22"

%22 is a percent-encoded double quote. Percent-decoding belongs to the URL
layer, and this q is in a request BODY, where nothing decodes it - so the value
seen by the broker is literally %22urn:ngsi-ld:Building:farm001%22, which is
neither a quoted string nor a URI. A broker that validates the q grammar
rejects it with 400.

Replaced with JSON-escaped quotes, which is what the clause asks for and parses
identically everywhere:

    "q": "filling>0.6;filling<0.8;controlledAsset==\"urn:ngsi-ld:Building:farm001\""

All five payloads on the page still parse as valid JSON.

Also: 'x-nsgiv2-keyValues' and 'x-nsgiv2-keyValues-compacted' in the custom
format list are misspellings of x-ngsiv2.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant