157239633: Spaces converted to plus when included in a dynamic link

Describe your environment

• Android Studio version: 3.5.1
• Firebase Component: Dynamic links
• Component version: 19.0.0

Describe the problem

I’ve created a deep link with a query parameter that contains A + B. The query parameter is url encoded before being passed to setLink():

FirebaseDynamicLinks.getInstance().createDynamicLink().setLink("https://example.appspot.com/?parameter=A%20%2B%20B")

When I later open this dynamic link the value of the parameter is not what I expect. In the onSuccess method of the OnSuccessListener the value of pendingDynamicLinkData.link is:

https://example.appspot.com/?parameter=A+++B

Both spaces (%20) and pluses (%2b) are converted to + when doing the URL decoding making it impossible to pass any spaces trough a dynamic link.

[nibarius]

As far as I know space is the only character where this happens. I think the problem comes from mixing java.net.URLEncoder.encode() with android.net.Uri.decode(). The former “Translates a string into application/x-www-form-urlencoded format using a specific encoding scheme.” while the later percent encode all characters that are not unreserved characters, letters or numbers which including space and plus.

Here’s an example of what happens when you encode using one scheme and decode using the other. Code:

        val jEnc = java.net.URLEncoder.encode("a + b")
        val jEncjDec = java.net.URLDecoder.decode(jEnc)
        val aEnc = android.net.Uri.encode("a + b")
        val aEncADec = android.net.Uri.decode(aEnc)
        val jEncADec = android.net.Uri.decode(jEnc)
        val aEncJDec = java.net.URLDecoder.decode(aEnc)

        Log.e("encoding", "URLEncoder.encode(): $jEnc, then decoded with URLDecoder.decode(): $jEncjDec")
        Log.e("encoding", "Uri.encode(): $aEnc, then decoded with Uri.decode(): $aEncADec")
        Log.e("encoding", "URLEncoder.encode(): $jEnc, then decoded with Uri.decode(): $jEncADec")
        Log.e("encoding", "Uri.encode(): $aEnc, then decoded with URLDecoder.decode(): $aEncJDec")

Output:

E/encoding: URLEncoder.encode(): a+%2B+b, then decoded with URLDecoder.decode(): a + b
E/encoding: Uri.encode(): a%20%2B%20b, then decoded with Uri.decode(): a + b
E/encoding: URLEncoder.encode(): a+%2B+b, then decoded with Uri.decode(): a+++b
E/encoding: Uri.encode(): a%20%2B%20b, then decoded with URLDecoder.decode(): a + b

The second to last line illustrate exactly the problem we are having here.

[nibarius]

I’m not sure I agree with that completely. When doing percent encoding for URIs, like the Firebase deep links, spaces should be encoded as %20. This is explicitly mentioned in RFC 3986 which defines the format of URIs including how data in it should be encoded.

The confusion around this comes from how browsers submits data from forms. Here they use the mime type application/x-www-form-urlencoded (which is not the same as percent encoded URIs).

Wikipedia mentions the following:

The encoding used by default is based on an early version of the general URI percent-encoding rules,[4] with a number of modifications such as newline normalization and replacing spaces with + instead of %20

This section refers to RFC1630, which does mention that space is encoded as plus. It does however also mention that plus signs need to be encoded

Within the query string, the plus sign is reserved as shorthand notation for a space. Therefore, real plus signs must be encoded.

So regardless if the old standard, or the new standard is used, it should always be possible to both encode and decode a string containing both plus and space without loosing any of them.