ERROR 400 Ambiguous URI path separator

[ybelMekk]

Current Behavior

In my test environment, I set up a Docker Compose file with Dependency-Track version 4.12.0.

In production, we are currently running version 4.11.7, and the endpoint described below works without issues, both in production and the test environment.

We make extensive use of tags, especially prior to the introduction of the new tag feature, so it's fair to say that we overuse the /project/tag endpoint.

In the latest version, however, I'm unable to query tags because I receive a ERROR 400 Ambiguous URI path separator when a request query includes a tag that contains a forward slash /.

Were there any changes in the latest release regarding the handling of UTF-8 encoded query strings? Specifically, is there now any support for queries with slashes in tags?

Steps to Reproduce

1. Any query escaped string containing a slash to endpoint /project/tag`.

For example:

curl -X 'GET' \
  'http://localhost:9010/api/v1/project/tag/project%3Aeurope-north1-docker.pkg.dev%2Fmy-p?pageNumber=1&pageSize=100' \
  -H 'accept: application/json' \
  -H 'X-Api-Key: my-key'

Expected Behavior

Return all projects with that tag.

Dependency-Track Version

4.12.0

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15

Browser

Other

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

Appears to be caused by a behavior change in Jetty: jetty/jetty.project#12162

[ybelMekk]

Thanks for quick feedback @nscuro .

[nscuro]

There seem to be ways to make it behave like before, I'll ensure we ship a fix with the next bugfix release.

[janweinkauff]

We’re experiencing the same issue and are looking forward to the fix. 🚀

[nscuro]

Just waiting for an Alpine release so we can pull the fix in. Will release v4.12.1 immediately afterwards, it's ready otherwise.