- Shipped
- September 5, 2026 at 6:35 AM UTC
- Author
- Kamo
- Commit
- a5989d7
The folder travelled as a path segment, and Gmail separates its hierarchy with "/" — its Sent folder is `[Gmail]/Sent Mail`. There is no way to put that in one segment: * encoded once, the %2F is refused by Tomcat and again by Spring Security's StrictHttpFirewall, 400 Bad Request before any handler runs; * encoded twice — which this controller's own second decode would otherwise want — the %25 is refused by the same firewall. It refuses it precisely because a service that decodes a path twice is the shape path-traversal bypasses are made of, and relaxing that service-wide to move a folder name would be a poor trade. So the name now arrives as a `folder` query parameter, where neither rule applies and Spring's single decode is exact. The path segment is still read when the query is absent, so every URL already issued keeps working; a caller sending the query leaves a placeholder in the path. This also fixes two quieter faults of the old form, which decoded twice and so read a folder called "Q3 + Q4" as "Q3 Q4" and one called "100% Done" as an escape sequence.