[jwrosewell]

The problem

The web integration supplies the method and the path of the request line as Evidence, and not the query string. web-integration.md lines 95 to 114 at 706de1f0 list "Request query string, whole and undecoded. Key is server.request-query" beside the method and the path, and say:

The three request line values (server.request-method, server.request-path and server.request-query) MUST be supplied exactly as they appeared on the request line, byte for byte, with no decoding and no normalisation.

An integration that supplies these keys MUST supply all three on every request, with server.request-query empty when the request has no query string, so that an absent key always means the integration does not supply the request line rather than that the request had no query.

WebRequestEvidenceServiceCore.Default.addEvidenceFromRequest added server.request-method and server.request-path and nothing for the query. The servlet filter and the Spring interceptor both go through it, so neither supplied server.request-query. So an element that checks a signature over the request line, as the Agent Signature Element the specification names does, would have no query string to rebuild it from.

What changed

addEvidenceFromRequest now adds server.request-query from HttpServletRequest.getQueryString, which the servlet API gives as sent, with no decoding, and an empty string when the request has no query string. Like every other value it is added as Evidence only when an element in the Pipeline accepts the key, and it is recorded in the web request that usage sharing reads. Usage sharing never shares it, as request-query is already on the never-shared list (EvidenceKeyFilterShareUsage.java line 110), because the whole query string would undo the rules for its parameters, which share only 51D_ ones by default.

Tests

Tests first, in 6bf4870b, a new class RequestLineEvidenceTests in pipeline.web. Each test gives the service Flow Data whose Evidence key filter accepts the three request line keys.

• RequestQuery_SuppliedWholeAndUndecoded sends a GET for /a with the query string x=%2F&y=1 and expects the method, the path and server.request-query as x=%2F&y=1.
• RequestQuery_NoQueryString_SuppliedEmpty sends a GET for /a with no query string and expects server.request-query as an empty string.

Red 43616169242 on 6bf4870 plus a throwaway workflow, Java 17. Both new tests fail ("Argument(s) are different"), and PipelineFilterTests (12) and UsageSharingEvidenceTests (7) pass.

Green 43616169257 on the fix a9f5dc8e plus the same workflow. 2, 12 and 7 pass.

Full build

Run 43617663019 built a9f5dc8 merged with rc (b33daa0) on nine configurations, Ubuntu x64 with Java 8, 11, 17 and 21, Ubuntu arm64 with Java 17, and Windows with Java 8, 11, 17 and 21, and every job passed. RequestLineEvidenceTests passed 2 of 2 and PipelineFilterTests 12 of 12 in all nine jobs. Each of its ten Setting 'PullRequestSha' lines names a9f5dc8, and its Configure job printed "Left out 6 macOS entries".

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

What it releases

pipeline.web changes, which is in Monday's plan under version per package (#63) already.

Base branch

rc at b33daa0, and a trial merge of the head with rc at 32b3784 is clean. #67 changes only a Javadoc in WebRequestEvidence.java of the same package, and a trial merge of the two was clean.