When a test case targets GraphQL over GET (e.g. testcases/owasp-api/graphql.yml, which uses encoder: URL), the payload is URL-encoded twice, so the request that reaches the target is not what the test case intends. This seems to be inconsistent with the sibling URL placeholders. URLPath and URLParam concatenate the already-encoded payload directly (requestURL += payload, urlpath.go:58 / urlparam.go:72), no re-encode. Their test cases use the same encoder: URL and get single-encoding. Only the GraphQL GET placeholder re-encodes.
Make the GraphQL GET placeholder concatenate the (already-encoded) payload into the query string verbatim, matching URLPath/URLParam:
if reqURL.RawQuery != "" {
reqURL.RawQuery += "&query=" + payload
} else {
reqURL.RawQuery = "query=" + payload
}
(Alternative: change graphql.yml to encoder: Plain. Fixing the placeholder is preferred — it makes encoder: URL behave consistently with every other URL placeholder.)
When a test case targets GraphQL over GET (e.g. testcases/owasp-api/graphql.yml, which uses encoder: URL), the payload is URL-encoded twice, so the request that reaches the target is not what the test case intends. This seems to be inconsistent with the sibling URL placeholders. URLPath and URLParam concatenate the already-encoded payload directly (requestURL += payload, urlpath.go:58 / urlparam.go:72), no re-encode. Their test cases use the same encoder: URL and get single-encoding. Only the GraphQL GET placeholder re-encodes.
Make the GraphQL GET placeholder concatenate the (already-encoded) payload into the query string verbatim, matching URLPath/URLParam:
if reqURL.RawQuery != "" {
reqURL.RawQuery += "&query=" + payload
} else {
reqURL.RawQuery = "query=" + payload
}
(Alternative: change graphql.yml to encoder: Plain. Fixing the placeholder is preferred — it makes encoder: URL behave consistently with every other URL placeholder.)