Keep embed params out of subresource self links

dspace-server-webapp/src/main/java/org/dspace/app/rest/RestResourceController.java

@@ -20,9 +20,11 @@
 import java.lang.reflect.Method;
 import java.sql.SQLException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.stream.Collectors;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -813,8 +815,8 @@ private <ID extends Serializable> RepresentationModel findRelInternal(HttpServle
                     }
 
                     Link link = null;
-                    String querystring = request.getQueryString();
-                    if (querystring != null && querystring.length() > 0) {
+                    String querystring = removeEmbedParamsFromQueryString(request.getQueryString());
+                    if (StringUtils.isNotEmpty(querystring)) {
                         link = linkTo(this.getClass(), apiCategory, model).slash(uuid)
                             .slash(subpath + '?' + querystring).withSelfRel();
                     } else {
@@ -1024,6 +1026,29 @@ public <T extends RestAddressableModel> RepresentationModel executeSearchMethods
      * @param parameters
      * @return encoded uriString containing request parameters without embed parameter
      */
+    /**
+     * Remove the "embed" and "embed.*" parameters from a raw query string.
+     *
+     * Embedding a subresource doesn't change which resource was requested, so it doesn't belong in
+     * that resource's self link. The collection and search endpoints already leave these out, via
+     * {@link #getEncodedParameterStringFromRequestParams}; this does the same for the subresource
+     * lists, which build their self link from the raw query string. The remaining parameters are
+     * passed through untouched, so the client's own encoding is preserved.
+     *
+     * @param querystring the raw query string, may be null
+     * @return the query string without embed parameters, empty if nothing is left
+     */
+    private String removeEmbedParamsFromQueryString(String querystring) {
+        if (StringUtils.isEmpty(querystring)) {
+            return "";
+        }
+        return Arrays.stream(StringUtils.split(querystring, '&'))
+                     .filter(param -> !StringUtils.equals(param, "embed")
+                         && !StringUtils.startsWith(param, "embed=")
+                         && !StringUtils.startsWith(param, "embed."))
+                     .collect(Collectors.joining("&"));
+    }
+
     private String getEncodedParameterStringFromRequestParams(
             @RequestParam MultiValueMap<String, Object> parameters) {
         UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.newInstance();

dspace-server-webapp/src/test/java/org/dspace/app/rest/BundleRestRepositoryIT.java

@@ -222,6 +222,29 @@ public void getItemBundles() throws Exception {
         ;
     }
 
+    @Test
+    public void getItemBundlesSelfLinkHasNoEmbedParams() throws Exception {
+
+        context.turnOffAuthorisationSystem();
+
+        bundle1 = BundleBuilder.createBundle(context, item).withName("testname").build();
+
+        context.restoreAuthSystemState();
+
+        // embedding a subresource doesn't change which resource was requested, so the embed params
+        // must not end up in its self link - the other params must survive untouched
+        getClient().perform(get("/api/core/items/" + item.getID() + "/bundles")
+                       .param("embed", "primaryBitstream")
+                       .param("embed.size", "bitstreams=5")
+                       .param("size", "10"))
+                   .andExpect(status().isOk())
+                   .andExpect(jsonPath("$._links.self.href",
+                           Matchers.containsString("/api/core/items/" + item.getID() + "/bundles")))
+                   .andExpect(jsonPath("$._links.self.href", Matchers.not(Matchers.containsString("embed"))))
+                   .andExpect(jsonPath("$._links.self.href", Matchers.containsString("size=10")))
+        ;
+    }
+
     @Test
     public void createBundleWithoutMetadata() throws Exception {
         ObjectMapper mapper = new ObjectMapper();