url encoded query parameters

Author: Calvinjmin

CMakeLists.txt

@@ -128,6 +128,7 @@ set(SOURCES
     src/internal/pool_manager.cpp
     src/internal/logger.cpp
     src/internal/http_client.cpp
+    src/internal/url_utils.cpp
 )
 
 set(HEADERS
@@ -152,6 +153,7 @@ set(INTERNAL_HEADERS
     src/internal/pool_manager.h
     src/internal/logger.h
     src/internal/http_client.h
+    src/internal/url_utils.h
 )
 
 # Create library target

src/compute/compute.cpp

@@ -5,6 +5,7 @@
 #include "../internal/http_client.h"
 #include "../internal/http_client_interface.h"
 #include "../internal/logger.h"
+#include "../internal/url_utils.h"
 
 #include <nlohmann/json.hpp>
 
@@ -73,8 +74,11 @@ bool Compute::create_compute(const Cluster& cluster_config) {
 Cluster Compute::get_compute(const std::string& cluster_id) {
     internal::get_logger()->info("Getting compute cluster details for cluster_id=" + cluster_id);
 
+    // URL-encode the cluster_id to prevent injection
+    std::string encoded_id = internal::url_encode(cluster_id);
+
     // Make API request with cluster_id as query parameter
-    auto response = pimpl_->http_client_->get("/clusters/get?cluster_id=" + cluster_id);
+    auto response = pimpl_->http_client_->get("/clusters/get?cluster_id=" + encoded_id);
     pimpl_->http_client_->check_response(response, "getCompute");
 
     internal::get_logger()->debug("Compute cluster details response: " + response.body);

src/internal/url_utils.cpp

@@ -0,0 +1,32 @@
+// Copyright (c) 2025 Calvin Min
+// SPDX-License-Identifier: MIT
+#include "url_utils.h"
+
+#include <stdexcept>
+
+#include <curl/curl.h>
+
+namespace databricks {
+namespace internal {
+
+std::string url_encode(const std::string& str) {
+    CURL* curl = curl_easy_init();
+    if (!curl) {
+        throw std::runtime_error("Failed to initialize CURL for URL encoding");
+    }
+
+    char* encoded = curl_easy_escape(curl, str.c_str(), static_cast<int>(str.length()));
+    if (!encoded) {
+        curl_easy_cleanup(curl);
+        throw std::runtime_error("Failed to URL encode string");
+    }
+
+    std::string result(encoded);
+    curl_free(encoded);
+    curl_easy_cleanup(curl);
+
+    return result;
+}
+
+} // namespace internal
+} // namespace databricks

src/internal/url_utils.h

@@ -0,0 +1,31 @@
+// Copyright (c) 2025 Calvin Min
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <string>
+
+namespace databricks {
+namespace internal {
+
+/**
+ * @brief URL-encode a string to safely include in query parameters
+ *
+ * Encodes special characters in a string to make it safe for use in URLs.
+ * Uses libcurl's curl_easy_escape function for RFC 3986 compliant encoding.
+ *
+ * @param str String to encode
+ * @return std::string URL-encoded string
+ *
+ * @throws std::runtime_error if CURL initialization or encoding fails
+ *
+ * @example
+ * std::string encoded = url_encode("hello world");
+ * // Returns: "hello%20world"
+ *
+ * std::string safe = url_encode("cluster&id=123");
+ * // Returns: "cluster%26id%3D123"
+ */
+std::string url_encode(const std::string& str);
+
+} // namespace internal
+} // namespace databricks

src/jobs/jobs.cpp

@@ -5,6 +5,7 @@
 #include "../internal/http_client.h"
 #include "../internal/http_client_interface.h"
 #include "../internal/logger.h"
+#include "../internal/url_utils.h"
 
 #include <sstream>
 #include <stdexcept>
@@ -32,7 +33,7 @@ class Jobs::Impl {
 // ============================================================================
 
 namespace {
-// Build query string from parameters
+// Build query string from parameters with URL encoding
 std::string build_query_string(const std::map<std::string, std::string>& params) {
     if (params.empty()) {
         return "";
@@ -45,7 +46,7 @@ std::string build_query_string(const std::map<std::string, std::string>& params)
         if (!first) {
             oss << "&";
         }
-        oss << key << "=" << value;
+        oss << key << "=" << internal::url_encode(value);
         first = false;
     }
     return oss.str();

src/secrets/secrets.cpp

@@ -5,6 +5,7 @@
 #include "../internal/http_client.h"
 #include "../internal/http_client_interface.h"
 #include "../internal/logger.h"
+#include "../internal/url_utils.h"
 
 #include <unordered_map>
 
@@ -144,8 +145,8 @@ void Secrets::delete_secret(const std::string& scope, const std::string& key) {
 std::vector<Secret> Secrets::list_secrets(const std::string& scope) {
     internal::get_logger()->info("Listing secrets in scope: " + scope);
 
-    // Make GET request with scope as query parameter
-    auto response = pimpl_->http_client_->get("/secrets/list?scope=" + scope);
+    // Make GET request with scope as query parameter (URL-encoded)
+    auto response = pimpl_->http_client_->get("/secrets/list?scope=" + internal::url_encode(scope));
     pimpl_->http_client_->check_response(response, "listSecrets");
 
     internal::get_logger()->debug("Successfully retrieved secrets list");

src/unity_catalog/unity_catalog.cpp

@@ -5,6 +5,7 @@
 #include "../internal/http_client.h"
 #include "../internal/http_client_interface.h"
 #include "../internal/logger.h"
+#include "../internal/url_utils.h"
 
 #include <nlohmann/json.hpp>
 
@@ -51,7 +52,7 @@ std::vector<CatalogInfo> UnityCatalog::list_catalogs() {
 CatalogInfo UnityCatalog::get_catalog(const std::string& catalog_name) {
     internal::get_logger()->info("Getting catalog details for catalog=" + catalog_name);
 
-    auto response = pimpl_->http_client_->get("/unity-catalog/catalogs/" + catalog_name);
+    auto response = pimpl_->http_client_->get("/unity-catalog/catalogs/" + internal::url_encode(catalog_name));
     pimpl_->http_client_->check_response(response, "getCatalog");
 
     internal::get_logger()->debug("Catalog details response: " + response.body);
@@ -109,7 +110,7 @@ bool UnityCatalog::delete_catalog(const std::string& catalog_name, bool force) {
 std::vector<SchemaInfo> UnityCatalog::list_schemas(const std::string& catalog_name) {
     internal::get_logger()->info("Listing schemas in catalog: " + catalog_name);
 
-    auto response = pimpl_->http_client_->get("/unity-catalog/schemas?catalog_name=" + catalog_name);
+    auto response = pimpl_->http_client_->get("/unity-catalog/schemas?catalog_name=" + internal::url_encode(catalog_name));
     pimpl_->http_client_->check_response(response, "listSchemas");
 
     internal::get_logger()->debug("Schemas list response: " + response.body);
@@ -119,7 +120,7 @@ std::vector<SchemaInfo> UnityCatalog::list_schemas(const std::string& catalog_na
 SchemaInfo UnityCatalog::get_schema(const std::string& full_name) {
     internal::get_logger()->info("Getting schema details for: " + full_name);
 
-    auto response = pimpl_->http_client_->get("/unity-catalog/schemas/" + full_name);
+    auto response = pimpl_->http_client_->get("/unity-catalog/schemas/" + internal::url_encode(full_name));
     pimpl_->http_client_->check_response(response, "getSchema");
 
     internal::get_logger()->debug("Schema details response: " + response.body);
@@ -169,8 +170,9 @@ bool UnityCatalog::delete_schema(const std::string& full_name) {
 std::vector<TableInfo> UnityCatalog::list_tables(const std::string& catalog_name, const std::string& schema_name) {
     internal::get_logger()->info("Listing tables in " + catalog_name + "." + schema_name);
 
-    // Create Endpoint with Catalog and Schema name
-    std::string endpoint = "/unity-catalog/tables?catalog_name=" + catalog_name + "&schema_name=" + schema_name;
+    // Create Endpoint with Catalog and Schema name (URL-encoded)
+    std::string endpoint = "/unity-catalog/tables?catalog_name=" + internal::url_encode(catalog_name) +
+                          "&schema_name=" + internal::url_encode(schema_name);
     auto response = pimpl_->http_client_->get(endpoint);
     pimpl_->http_client_->check_response(response, "listTables");
 
@@ -181,7 +183,7 @@ std::vector<TableInfo> UnityCatalog::list_tables(const std::string& catalog_name
 TableInfo UnityCatalog::get_table(const std::string& full_name) {
     internal::get_logger()->info("Getting table details for: " + full_name);
 
-    auto response = pimpl_->http_client_->get("/unity-catalog/tables/" + full_name);
+    auto response = pimpl_->http_client_->get("/unity-catalog/tables/" + internal::url_encode(full_name));
     pimpl_->http_client_->check_response(response, "getTable");
 
     internal::get_logger()->debug("Table details response: " + response.body);

src/workspace/workspace.cpp

@@ -5,6 +5,7 @@
 #include "../internal/http_client.h"
 #include "../internal/http_client_interface.h"
 #include "../internal/logger.h"
+#include "../internal/url_utils.h"
 
 #include <sstream>
 #include <stdexcept>
@@ -52,8 +53,8 @@ std::vector<ObjectInfo> Workspace::list(const std::string& path,
         throw std::invalid_argument("Path cannot be empty");
     }
 
-    // Build query parameters
-    std::string query_params = "?path=" + path;
+    // Build query parameters with URL encoding
+    std::string query_params = "?path=" + internal::url_encode(path);
     if (notebooks_modified_after.has_value()) {
         query_params += "&notebooks_modified_after=" + std::to_string(notebooks_modified_after.value());
     }
@@ -94,8 +95,8 @@ ObjectInfo Workspace::get_status(const std::string& path) {
         throw std::invalid_argument("Path cannot be empty");
     }
 
-    // Build query parameters
-    std::string query_params = "?path=" + path;
+    // Build query parameters with URL encoding
+    std::string query_params = "?path=" + internal::url_encode(path);
 
     auto response = pimpl_->http_client_->get("/workspace/get-status" + query_params);
     pimpl_->http_client_->check_response(response, "getStatus");
@@ -112,8 +113,8 @@ ExportResponse Workspace::export_file(const std::string& path, ExportFormat form
         throw std::invalid_argument("Path cannot be empty");
     }
 
-    // Build query parameters
-    std::string query_params = "?path=" + path;
+    // Build query parameters with URL encoding
+    std::string query_params = "?path=" + internal::url_encode(path);
     query_params += "&format=" + export_format_to_string(format);
 
     internal::get_logger()->debug("Export request for path=" + path + ", format=" + export_format_to_string(format));