[API Policies] Prompt Template Policy Issue

[DakshithaS]

Overview

Double URL decoding vulnerability in query parameter processing leads to incorrect parameter values and malformed prompts.

---

Issue Details

Double URL Decoding of Query Parameters

File: prompttemplate.go (lines 186-202)

Description:
The code performs double URL decoding on query parameter values. The url.ParseQuery function already returns URL-decoded values, but the code then calls url.QueryUnescape on values[0], causing incorrect double-decoding.

Example:

Original: %2520 (URL-encoded %20)
ParseQuery: %20 (first decode)
QueryUnescape: (space character) (second decode - INCORRECT)

Proposed Fix:
Remove the url.QueryUnescape call since url.ParseQuery already handles decoding.

Impact:
Template parameters will have incorrect values, leading to malformed prompts and potential security issues.

Reference

• Consolidate APIM policies into gateway-controllers repository gateway-controllers#1