From 5c236d04e1318cf6fca39b8dfc7c17c9bbc837f0 Mon Sep 17 00:00:00 2001
From: zouzanyan <qq1406823510@163.com>
Date: Sun, 18 Jan 2026 14:27:59 +0800
Subject: [PATCH] =?UTF-8?q?1.=20=E4=BF=AE=E5=A4=8D=20HttpUtil.normalizePar?=
 =?UTF-8?q?ams=20=E5=9C=A8=E6=9E=81=E7=AB=AF=E8=BE=93=E5=85=A5=E4=B8=8B?=
 =?UTF-8?q?=E6=8A=9B=20StringIndexOutOfBoundsException=202.=20HttpUtil.bui?=
 =?UTF-8?q?ldBasicAuth=20=E5=A2=9E=E5=8A=A0=20username=20=E5=92=8C=20passw?=
 =?UTF-8?q?ord=20=E9=9D=9E=E7=A9=BA=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/cn/hutool/http/HttpUtil.java        | 11 ++++++++---
 .../src/test/java/cn/hutool/http/HttpUtilTest.java    |  6 ++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/hutool-http/src/main/java/cn/hutool/http/HttpUtil.java b/hutool-http/src/main/java/cn/hutool/http/HttpUtil.java
index 10093e61b6..2b6901b699 100755
--- a/hutool-http/src/main/java/cn/hutool/http/HttpUtil.java
+++ b/hutool-http/src/main/java/cn/hutool/http/HttpUtil.java
@@ -5,6 +5,7 @@ import cn.hutool.core.convert.Convert;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.io.IoUtil;
 import cn.hutool.core.io.StreamProgress;
+import cn.hutool.core.lang.Assert;
 import cn.hutool.core.map.MapUtil;
 import cn.hutool.core.net.RFC3986;
 import cn.hutool.core.net.url.UrlQuery;
@@ -580,9 +581,11 @@ public class HttpUtil {
 		}
 
 		// 以&结尾则去除之
-		int lastIndex = builder.length() - 1;
-		if ('&' == builder.charAt(lastIndex)) {
-			builder.delTo(lastIndex);
+		if (!builder.isEmpty()) {
+			int lastIndex = builder.length() - 1;
+			if ('&' == builder.charAt(lastIndex)) {
+				builder.delTo(lastIndex);
+			}
 		}
 		return builder.toString();
 	}
@@ -883,6 +886,8 @@ public class HttpUtil {
 	 * @since 5.4.6
 	 */
 	public static String buildBasicAuth(String username, String password, Charset charset) {
+		Assert.notNull(username, "username must not be null");
+		Assert.notNull(password, "password must not be null");
 		final String data = username.concat(":").concat(password);
 		return "Basic " + Base64.encode(data, charset);
 	}
diff --git a/hutool-http/src/test/java/cn/hutool/http/HttpUtilTest.java b/hutool-http/src/test/java/cn/hutool/http/HttpUtilTest.java
index 8f3e8aa3ca..dfa52a9617 100755
--- a/hutool-http/src/test/java/cn/hutool/http/HttpUtilTest.java
+++ b/hutool-http/src/test/java/cn/hutool/http/HttpUtilTest.java
@@ -327,6 +327,12 @@ public class HttpUtilTest {
 		assertEquals("", encodeResult);
 	}
 
+	@Test
+	public void normalizEampersandParamsTest() {
+		final String encodeResult = HttpUtil.normalizeParams("&", CharsetUtil.CHARSET_UTF_8);
+		assertEquals("", encodeResult);
+	}
+
 	@Test
 	public void getMimeTypeTest() {
 		final String mimeType = HttpUtil.getMimeType("aaa.aaa");