RoutingContext.normalizedPath should be decoded when used for matching against non encoded path

[ia3andy]

Describe the bug

For example, sending a request with encoded chars such as %20 is not working for static files which is not decoding RoutingContext.normalizedPath

Expected behavior

200 with file content

Actual behavior

404 not found (in prod mode)
200 in dev-mode

How to Reproduce?

https://github.com/ia3andy/reproducer-space

there are two tests:

• one that shows that the Vertx web client is not encoding the path (error 400 bad request)
• one that shows that Quarkus static handler is not working as it should in prod mode

Output of uname -a or ver

No response

Output of java -version

No response

Quarkus version or git rev

3.17

Build tool (ie. output of mvnw --version or gradlew --version)

No response

[ia3andy]

As soon as it's confirmed on vert.x, we could fix this by making sure we are decoding the normalizedPath everywhere it's used (in a wrapper method so we can remove this if fixed someday).

[ia3andy]

I will provide a fix by decoding after using normalizedPath everywhere it's needed in Quarkus.

Like it's done in vertx:
https://github.com/vert-x3/vertx-web/blob/master/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java#L166

[ia3andy]

As the uri decoding library is not public in Vert.x, the plan is:

• Create a new independent project lib based on RFC3986 (and also add PathUtils inside it)
• Use this lib everywhere needed in Quarkus to decode normalizedPath
• Delegate usage of RR URIDecoder to this lib
• Use this lib in Quarkiverse extensions to decode normalizedPath

For the record, PathUtils is also copied across a few extensions already (Quinoa, Qute Web, Roq, Web Bundler) and I noticed the logic to deal with paths is recoded many times in Quarkus core and some other extensions, so it might make sense to have it available in that new module (it's unrelated to this particular issue)

[FroMage]

If you make a URI decoding API, it should deserialise to structures representing the URI. Not to String. Otherwise it will be wrong.