[BUG] Spring SDK @RequestParam values are appended without URL encoding #7464

Description

The Spring SDK request proxy appends @RequestParam keys and values directly into the URL. RequestParamParameterProcessor builds the query string with urlResult.append(key).append("=").append(value), so reserved characters are interpreted as URL syntax instead of parameter data.

Location

• shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java:64
• Caller path: shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/proxy/ShenyuClientMethodHandler.java:92

Impact

A call such as get(@RequestParam("q") String q) with q = "a&admin=true" sends ?q=a&admin=true, changing one logical parameter into two. Values containing spaces, =, %, or non-ASCII characters can also be malformed or parsed differently by the gateway/upstream.

Suggested fix

Percent-encode query parameter names and values before appending them. Add regression coverage for reserved characters, spaces, existing query strings, and map-valued @RequestParam.

Related existing issues

Different from #6489 (composition order) and #6751 (different path builder).

Reviewed Revision And Validation

Apache ShenYu 2.7.2-SNAPSHOT, master at a89b6a2. Severity: medium. Confidence: high.

Current Spring SDK processor harness reproduced query-value splitting. See registration/counterchecks.md and harnesses/SpringSdkHarness.java.

Current source references:

• shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/RequestParamParameterProcessor.java:64
• shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/proxy/ShenyuClientMethodHandler.java:92

No implementation fix or full deployed end-to-end validation was performed by this review. Source-flow and runtime evidence are distinguished above.