diff --git a/src/core/server/core_app/core_app.ts b/src/core/server/core_app/core_app.ts index bd7de6b20226c..176b93b36d8fd 100644 --- a/src/core/server/core_app/core_app.ts +++ b/src/core/server/core_app/core_app.ts @@ -173,7 +173,9 @@ export class CoreApp { } const querystring = query ? stringify(query) : undefined; - const url = `${requestBasePath}/${rewrittenPath}${querystring ? `?${querystring}` : ''}`; + const url = `${requestBasePath}/${encodeURIComponent(rewrittenPath)}${ + querystring ? `?${querystring}` : '' + }`; return res.redirected({ headers: { diff --git a/src/core/server/core_app/integration_tests/core_app_routes.test.ts b/src/core/server/core_app/integration_tests/core_app_routes.test.ts index 77bb1cca9d93d..2a813d5040cb4 100644 --- a/src/core/server/core_app/integration_tests/core_app_routes.test.ts +++ b/src/core/server/core_app/integration_tests/core_app_routes.test.ts @@ -53,6 +53,11 @@ describe('Core app routes', () => { const response = await kbnTestServer.request.get(root, '/base-path/foo/').expect(302); expect(response.get('location')).toEqual('/base-path/foo'); }); + + it('URI encodes redirect path', async () => { + const response = await kbnTestServer.request.get(root, '/%5Csome-path/').expect(302); + expect(response.get('location')).toEqual('/base-path/%5Csome-path'); + }); }); describe('`/` route', () => {