Encode the path in uri

[adkharat]

Description

CWE-235

Fixed Http Parameter Pollution Rule at :

(1) Encoded URI path parameter /v1/taskInfo/{taskId} with UTF_8 encoding : presto-main/src/main/java/com/facebook/presto/resourcemanager/DistributedTaskInfoResource.java:72
(2) presto-main/src/main/java/com/facebook/presto/server/protocol/QueryResourceUtil.java

Motivation and Context

Concatenating untrusted input into path, query string, or parameters for HTTP message (in the URL or in the request body) may allow an attacker to override/add unexpected request parameters. Attacker may change the intended HTTP request semantics, and may give him/her access to unauthorized data or bypass web application firewall validations.

Impact

No Impact

Test Plan

Verified existing Unit test case for above fix :
(1) presto-tests/src/test/java/com/facebook/presto/resourcemanager/TestDistributedTaskInfoResource.java
(2) presto-tests/src/test/java/com/facebook/presto/server/TestQueryResource.java

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

* Security Changes
 Fixes URI path parameter encoding to handle untrusted input : pr:`23907`

[tdcmeehan]

Instead of UTF-8 encoding the task and other elements on the path, can't we simply disallow any additional query parameters? The task ID is validated, can't we simply disallow any other parameters.