Skip to content

Conversation

@VijayabaskarR-06
Copy link

Semantic Versioning lets us use "+" for build metadata (like 1.0.0+10), but AWS S3 sees "+" as a space even in URL path segments, which causes 403 errors when we try to access extension resources. This change makes sure that '+' is always encoded as '%2B' when building API URLs in UrlUtil.createApiUrl. This keeps Semantic Versioning the same.

In short It was possible to publish extensions that used Semantic Versioning with build metadata (for example, 1.0.0+10), but later they wouldn't load or download, which caused 403 errors. The + sign in URLs is treated as a space by AWS S3, even in path segments.

UriUtils.encodePathSegment not encoding the + character when making API URLs was the cause of the problem. Because of this, URLs with versions that had + were made wrong for resources that were backed by S3. When making URL path segments, this change fixes the problem by explicitly encoding + as %2B in UrlUtil.createApiUrl. The fix is applied in one place, so it affects all API URLs in the same way, without changing Semantic Versioning.

@netomi
Copy link
Contributor

netomi commented Jan 13, 2026

I tried that approach already and it leads to spring automatically encoding the % again. So a fix would need to change the default spring behavior.

@VijayabaskarR-06
Copy link
Author

Thanks I see that pre-encoding causes double-encoding due to Spring’s default behaviour.
I’ll update the fix to rely on Spring’s path-segment encoding instead of manual %2B, so the + is encoded correctly without being re-escaped

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants