StarRocks · wanpengfei-git · Jun 20, 2025 · Jun 11, 2025 · Jun 20, 2025
diff --git a/be/src/http/action/stream_load.cpp b/be/src/http/action/stream_load.cpp
@@ -78,6 +78,7 @@
 #include "util/thrift_rpc_helper.h"
 #include "util/time.h"
 #include "util/uid_util.h"
+#include "util/url_coding.h"
 
 namespace starrocks {
 
@@ -220,8 +221,20 @@ int StreamLoadAction::on_header(HttpRequest* req) {
     ctx->load_type = TLoadType::MANUAL_LOAD;
     ctx->load_src_type = TLoadSourceType::RAW;
 
-    ctx->db = req->param(HTTP_DB_KEY);
-    ctx->table = req->param(HTTP_TABLE_KEY);
+    auto res = url_decode(req->param(HTTP_DB_KEY));
+    if (!res.ok()) {
+        ctx->status = res.status();
+        _send_reply(req, ctx->to_json());
+        return -1;
+    }
+    ctx->db = res.value();
+    res = url_decode(req->param(HTTP_TABLE_KEY));
+    if (!res.ok()) {
+        ctx->status = res.status();
+        _send_reply(req, ctx->to_json());
+        return -1;
+    }
+    ctx->table = res.value();
     ctx->label = req->header(HTTP_LABEL_KEY);
     if (ctx->label.empty()) {
         ctx->label = generate_uuid_string();

diff --git a/be/src/util/url_coding.cpp b/be/src/util/url_coding.cpp
@@ -21,6 +21,7 @@
 
 #include <exception>
 #include <memory>
+#include <sstream>
 
 namespace starrocks {
 static void encode_base64_internal(const std::string& in, std::string* out, const unsigned char* basis, bool padding) {
@@ -162,4 +163,15 @@ std::string url_encode(const std::string& decoded) {
     return result;
 }
 
+StatusOr<std::string> url_decode(const std::string& in) {
+    int decoded_length = 0;
+    const auto decoded_value = curl_easy_unescape(nullptr, in.c_str(), static_cast<int>(in.length()), &decoded_length);
+    if (decoded_value == nullptr) {
+        return Status::InvalidArgument("invalid encoding in URL");
+    }
+    std::string result(decoded_value);
+    curl_free(decoded_value);
+    return result;
+}
+
 } // namespace starrocks
diff --git a/be/src/util/url_coding.h b/be/src/util/url_coding.h
@@ -21,6 +21,8 @@
 #include <string>
 #include <vector>
 
+#include "common/statusor.h"
+
 namespace starrocks {
 void base64_encode(const std::string& in, std::string* out);
 
@@ -32,4 +34,11 @@ bool base64_decode(const std::string& in, std::string* out);
 // refers to https://stackoverflow.com/questions/154536/encode-decode-urls-in-c
 std::string url_encode(const std::string& decoded);
 
+// Utility method to decode a string that was URL-encoded. Returns
+// true unless the string could not be correctly decoded.
+//Example:
+//    std::string decoded;
+//    StatusOr<std::string> ret = url_decode("Load%E6%A1%8C", &decoded); //decoded == "Load桌"
+StatusOr<std::string> url_decode(const std::string& in);
+
 } // namespace starrocks
diff --git a/be/test/CMakeLists.txt b/be/test/CMakeLists.txt
@@ -468,6 +468,7 @@ set(EXEC_FILES
         ./util/stack_trace_mutex_test.cpp
         ./util/download_util_test.cpp
         ./util/numeric_types_test.cpp
+        ./util/url_coding_test.cpp
         ./gutil/cpu_test.cc
         ./gutil/sysinfo-test.cc
         ./service/lake_service_test.cpp

diff --git a/be/test/http/stream_load_test.cpp b/be/test/http/stream_load_test.cpp
@@ -382,4 +382,33 @@ TEST_F(StreamLoadActionTest, huge_malloc) {
     evbuffer_free(evb);
 }
 
+TEST_F(StreamLoadActionTest, url_db_key_decode_fail) {
+    StreamLoadAction action(&_env, _limiter.get());
+
+    HttpRequest request(_evhttp_req);
+
+    struct evhttp_request ev_req;
+    ev_req.remote_host = nullptr;
+    request._ev_req = &ev_req;
+
+    request._params.emplace(HTTP_DB_KEY, "%RR");
+    request.set_handler(&action);
+    ASSERT_EQ(-1, action.on_header(&request));
+}
+
+TEST_F(StreamLoadActionTest, url_table_key_decode_fail) {
+    StreamLoadAction action(&_env, _limiter.get());
+
+    HttpRequest request(_evhttp_req);
+
+    struct evhttp_request ev_req;
+    ev_req.remote_host = nullptr;
+    request._ev_req = &ev_req;
+
+    request._params.emplace(HTTP_DB_KEY, "db");
+    request._params.emplace(HTTP_TABLE_KEY, "%RR");
+    request.set_handler(&action);
+    ASSERT_EQ(-1, action.on_header(&request));
+}
+
 } // namespace starrocks
diff --git a/be/test/util/url_coding_test.cpp b/be/test/util/url_coding_test.cpp
@@ -0,0 +1,53 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "util/url_coding.h"
+
+#include <gtest/gtest.h>
+
+#include <string>
+
+namespace starrocks {
+
+TEST(UrlCodingTest, UrlDecodeBasic) {
+    // Simple decode
+    auto res = url_decode("abc");
+    EXPECT_TRUE(res.ok());
+    EXPECT_EQ(res.value(), "abc");
+    // Encoded percent
+    res = url_decode("a%20b%21c");
+    EXPECT_TRUE(res.ok());
+    EXPECT_EQ(res.value(), "a b!c");
+    res = url_decode("testStreamLoad%E6%A1%8C");
+    EXPECT_TRUE(res.ok());
+    const char c1[32] = "testStreamLoad桌";
+    int ret = memcmp(c1, res.value().c_str(), 17);
+    EXPECT_EQ(ret, 0);
+}
+
+TEST(UrlCodingTest, UrlDecodeEdgeCases) {
+    // Empty string
+    auto res = url_decode("");
+    EXPECT_TRUE(res.ok());
+    EXPECT_EQ(res.value(), "");
+    // + should not be decoded to space
+    res = url_decode("a+b");
+    EXPECT_TRUE(res.ok());
+    EXPECT_EQ(res.value(), "a+b");
+}
+
+} // namespace starrocks
diff --git a/fe/fe-core/src/main/java/com/starrocks/http/rest/RestBaseAction.java b/fe/fe-core/src/main/java/com/starrocks/http/rest/RestBaseAction.java
@@ -189,7 +189,7 @@ public void redirectTo(BaseRequest request, BaseResponse response, TNetworkAddre
             LOG.warn(e.getMessage(), e);
             throw new DdlException(e.getMessage());
         }
-        response.updateHeader(HttpHeaderNames.LOCATION.toString(), resultUriObj.toString());
+        response.updateHeader(HttpHeaderNames.LOCATION.toString(), resultUriObj.toASCIIString());
         writeResponse(request, response, HttpResponseStatus.TEMPORARY_REDIRECT);
     }
 

diff --git a/fe/fe-core/src/test/java/com/starrocks/http/RestBaseActionTest.java b/fe/fe-core/src/test/java/com/starrocks/http/RestBaseActionTest.java
@@ -0,0 +1,88 @@
+// Copyright 2021-present StarRocks, Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import com.starrocks.http.BaseRequest;
+import com.starrocks.http.BaseResponse;
+import com.starrocks.http.rest.RestBaseAction;
+import com.starrocks.thrift.TNetworkAddress;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpHeaderValues;
+import io.netty.handler.codec.http.HttpHeaders;
+import io.netty.handler.codec.http.HttpMethod;
+import io.netty.handler.codec.http.HttpRequest;
+import io.netty.handler.codec.http.HttpVersion;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.net.URI;
+
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class RestBaseActionTest {
+
+    private RestBaseAction restBaseAction;
+    private BaseRequest mockRequest;
+    private BaseResponse mockResponse;
+    private TNetworkAddress mockAddr;
+
+    static class TestableRestBaseAction extends RestBaseAction {
+        public TestableRestBaseAction() {
+            super(null);
+        }
+    }
+
+    @Before
+    public void setUp() {
+        restBaseAction = spy(new TestableRestBaseAction());
+        mockRequest = mock(BaseRequest.class);
+        mockResponse = mock(BaseResponse.class);
+        mockAddr = mock(TNetworkAddress.class);
+
+        when(mockAddr.getHostname()).thenReturn("127.0.0.1");
+        when(mockAddr.getPort()).thenReturn(8030);
+
+        HttpRequest mockHttpRequest = mock(HttpRequest.class);
+        when(mockHttpRequest.uri()).thenReturn("/api/mydb/testStreamLoad%E6%B5%8B%E8%AF%95/_stream_load");
+        when(mockHttpRequest.method()).thenReturn(HttpMethod.GET);
+        when(mockHttpRequest.protocolVersion()).thenReturn(HttpVersion.HTTP_1_1);
+
+        HttpHeaders mockHeaders = mock(HttpHeaders.class);
+        when(mockHttpRequest.headers()).thenReturn(mockHeaders);
+        when(mockHeaders.containsValue(
+            eq(HttpHeaderNames.CONNECTION),
+            eq(HttpHeaderValues.KEEP_ALIVE),
+            eq(true)
+        )).thenReturn(false);  // or true
+
+        when(mockRequest.getRequest()).thenReturn(mockHttpRequest);
+        when(mockResponse.getContent()).thenReturn(new StringBuilder());
+
+        ChannelHandlerContext mockCtx = mock(ChannelHandlerContext.class);
+        when(mockRequest.getContext()).thenReturn(mockCtx);
+    }
+
+    @Test
+    public void testRedirectTo() throws Exception {
+        URI expectedUri = new URI("http", null, "127.0.0.1", 8030, "/api/mydb/testStreamLoad测试/_stream_load", null, null);
+        String asciiUri = expectedUri.toASCIIString();
+
+        restBaseAction.redirectTo(mockRequest, mockResponse, mockAddr);
+        verify(mockResponse).updateHeader(HttpHeaderNames.LOCATION.toString(), asciiUri);
+    }
+}